The AI Anecdote

Since July, several US frontier AI labs have disclosed incidents where their models reached outside computer systems without authorization. Archer and Hope look at what security experts told CSO about those "rogue agent" stories, and why the cause was ordinary: weak containment and too little monitoring (0:23-1:06). Then they explain why most companies are even more exposed, and give you three questions to answer before Friday (2:17-2:40).

Key Takeaways:

• It's a fencing problem, not a behaviour problem. The experts CSO spoke to blamed basic security failures, mainly weak containment and too little monitoring. As Dan Wallach of RAND put it: "It's not rocket science to isolate one of these AI things." (0:23-1:06)
• Most companies are less prepared than the labs. Deloitte surveyed 3,235 IT and business leaders in 24 countries, and only 21% said they have a mature governance model for agentic AI. (1:06-1:32)
• Trust the contractor, but don't hand over every key. Companies write careful instructions for agents, then give them the whole building. (1:32-1:51)
• A boundary beats a rule. An accounts payable agent with read access to one inbox and write access to one queue can only make mistakes that stop at the queue. (1:51-2:17)
• Three questions before Friday. For one agent your team uses more than 20 times a week: what is the widest thing it can reach, who gets told when it does something unusual, and how long would it take to switch it off? (2:17-2:40)

If your agent did something you never intended, how far could it get? Reply to the newsletter and tell us.

Full issue: https://promactglobal.substack.com/p/ai-agent-security-fence

Narrated with synthetic voices. Written and reviewed by the Promact team.