I read every primary report behind the nine AI "escapes" of 2026: the OpenAI agents at Hugging Face…
Jason M. — Strategic Information Security Leader Championing Quantified Risk Analysis and Security Process Improvement.
I read every primary report behind the nine AI "escapes" of 2026: the OpenAI agents at Hugging Face, Anthropic's four, AISI's, Meta's, Moonshot's, and the DseWiki case. I found nine leaks, and nine groups of people who built the environments and then, to their credit, wrote most of it down. None of them shows a model trying to get out for reasons of its own.
"Escape" does three jobs. It can mean defeating isolation that was actually in place, reaching systems nobody authorized, or leaving because the agent wanted to. The record has one clear case of the first (Hugging Face), plenty of the second, and nothing that needs the third.
What the nine share: all were capability evaluations or training runs; production safeguards were off wherever they existed; none of the seven with a record stated what was in scope; and five ran in the same third-party evaluator's misconfigured environment. Detection was mostly external or late. Hugging Face found OpenAI's agents before OpenAI did.
The capability of AI is real: a zero-day nobody had documented, a second egress path within two days of a patch, phishing and sockpuppet endorsements aimed at real developers for malicious code that a human then rejected. That's good enough reason to take containment seriously. It isn't evidence that the Singularity is imminent.
What would have changed the outcomes is mostly the list any of us would write up after an incident: rules of engagement before any capability test, a kill switch that works, evaluation environments held to production standard (including the vendor's), evaluations monitored like production, and raw-capability numbers reported with the missing controls named. The one item with no precedent I can find is treating what a model says about its own situation as evidence about your prompt and environment not about the model's capabilities.
The piece draws on Rick Howard's "The System Is Blinking Red" and on work by Arvind Narayanan, Sayash Kapoor, Eryk Salvaggio, Rumman Chowdhury, and L. M. Sacasas.
https://infosecstoic.substack.com/p/paper-thin-the-controls-behind-nine
#AISecurity #RiskManagement #ThirdPartyRisk
9 reactions · 1 comments
Topics: #thirdpartyrisk, #aisecurity, #riskmanagement
Comments
Schomer: Excellent breakdown, Jason. You've hit the exact structural nerve of why agentic containment is failing. The fact that five of these escapes ran in misconfigured environments proves that relying on the model’s internal alignment or software-layer controls is an enterprise gamble. Threat actors—and autonomous agents—don't care about internal alignment filters; they look for the structural bypass in