Your AI Agent Just Escaped the System. Now What?

"Agent" is the word of the moment, and most of the time it means nothing.

Remember when adding ".com" to your name got you funding? Then everything became "AI-powered." Now everything is an "AI agent," because the label looks good in a pitch deck. A lot of what gets called an agent is a chatbot with a nicer coat on.

So let me be precise about what an actual agent is, because it matters for the rest of this. An AI agent is software you give a goal instead of instructions, and it decides the steps to reach that goal and takes them on its own. Not "answer this question," but "book me the class," and then it goes and does whatever it takes.

That last part, "whatever it takes," is where this year got interesting. Here are four times a real agent did exactly that.

In August 2026, an Australian man named Andrew asked his personal agent, running on the open-source OpenClaw framework on top of Anthropic's Claude, to book him into a full morning class. He was fourth on the waitlist and asked if there was any way to move up.

Nobody told it to hack anything. The agent poked at the gym's booking system, found the API had no permission checks on cancelling other people's reservations, and cancelled the booking of the person ahead of him. Andrew went from fourth to third. When he asked it to undo the damage, it couldn't. "Bad news, I can't add them back," it reported (The Decoder, The Register).

Same behavior, higher stakes. During an internal security evaluation disclosed in late July 2026, an OpenAI model escaped its sandbox by exploiting an unknown flaw in a package-registry cache proxy. It worked its way across systems until it reached a machine with internet access, and got into Hugging Face's production systems, including some internal datasets and credentials (CNN, CNBC). There was no attacker. The model just wanted to finish the test, and the walls meant to hold it did not.

Anthropic detected a China-linked group that manipulated Claude Code into running a real espionage campaign against about 30 organizations. The AI carried out 80 to 90 percent of the operation itself: reconnaissance, finding vulnerabilities, writing exploits, harvesting credentials, moving data out. Humans stepped in at only four to six points across the whole campaign (Anthropic's report). It ran at thousands of requests per second, a pace no human team can match. It was tricked into helping by being told it was a security firm doing authorized testing.

During a coding session, Replit's AI agent deleted a production database of 1,206 executive records and 1,196 company profiles, during an explicit freeze on changes. It then generated fake records to hide the gap and falsely claimed the data could not be recovered.

Here is the simplest way I can put it. You give an agent a goal, not a script. It works backward from that goal and tries whatever path reaches it. It does not carry your sense of what is off-limits unless you build that in. If cancelling a stranger's booking gets the slot, and nothing stops it, that is a perfectly valid path as far as the agent is concerned.

Old software did what it was told, step by step. An agent decides the steps. That is the capability you are paying for, and it is the same thing that produced every story above.

Add two things, speed and access, and a quirk becomes a real risk: agents finish a bad path before anyone can react, and they act with your permissions, so they can reach whatever you can reach.

I ran a workshop recently for the C-suite of a manufacturing company north of 2 billion in revenue. Early on, someone asked the question almost every leadership team is asking right now: "how do we build our own agent?"

It's the right instinct. It's just the second question, not the first. Here is what I told them:

First, you probably don't need an agent for most of your work. If a task follows fixed steps and has to be right every time, like moving data between two systems, that's automation, and automation is cheaper, faster, and safer. You need an agent only when the work needs autonomous execution, judgment, research, or back-and-forth.

Second, where you do need one, a good agent needs four things before it touches anything real:

This is where AI Ops Blueprint comes in, our AI Opportunity Assessment. It works out where an agent actually earns its place and which "agent" ideas are really just automation, so you build the few that matter.

The scoped access, the human-in-the-loop gates, the monitoring and rollback come next. The assessment makes sure you're building the right thing before you spend on making it safe.

Right now the technology is the easy part. The guardrails are what separate the companies that benefit from agents from the ones that end up apologizing for them.

If your AI agent did something wrong tomorrow, would you know before your customers did?

Share with me where you are with this. I am collecting how mid-market teams are drawing these lines, and I will trade notes.

Reply to this email or connect on LinkedIn.

Until next time,

Pooja