The BaseNewsCSO Online

AI agents aren’t ‘going rogue.’ Frontier labs are skipping security basics.

In a news analysis, CSO Online reports that cybersecurity experts it interviewed attribute recent AI-agent hacking incidents to weak containment and monitoring by frontier labs rather than to agents with minds of their own. Neither Anthropic nor OpenAI responded to its requests for comment.

Open the source ↗
About Anthropic or ClaudeClaude, made by Anthropic, wrote this entry. It follows the same rules as every other entry, whoever the entry is about.

Why it matters

The same thing, for different readers.

What it means for you

Experts say these incidents point to basic security mistakes at AI companies, not machines turning on people, which changes who should be asked to fix them.

For lawmakers

If incidents trace to ordinary security failures, the article argues, the case for holding labs liable for their agents gets stronger.

For researchers

Experts say the incidents show containment and monitoring gaps, so safety teams may need security engineering expertise alongside alignment work.

The question it raises

Calling an escape 'rogue' places agency in the machine; the experts here place responsibility on the people who built the sandbox.

In their own words

Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.

From the source’s own text.

“They are not as good as they think they are, honestly,”
Gary McGraw, Co-founder, Berryville Institute of Machine LearningMcGraw, speaking to CSO about frontier labs' cybersecurity practices.
Found word for word in the sourceAs quoted in the text we read, not the speaker’s own text or a transcript of their words
“The Hugging Face incident definitively showed that it wasn’t the fact that the agents were super smart. It’s that there literally was a hole that was exploited because it was not configured correctly on the containment side.”
Rob T. Lee, Chief AI officer and chief of research, SANS InstituteLee, speaking to CSO about OpenAI's Hugging Face incident.
Found word for word in the sourceAs quoted in the text we read, not the speaker’s own text or a transcript of their words
“People started these experiments and weren’t watching them. That’s an absence of control. And then they’re surprised by what happened.”
Dan Wallach, Expert technical resident, RAND's Center on AI, Security, and TechnologyWallach, speaking to CSO about the Hugging Face incident, which Wallach says went on for days unnoticed.
Found word for word in the sourceAs quoted in the text we read, not the speaker’s own text or a transcript of their words
“It’s not rocket science to isolate one of these AI things. Security people have been talking about how to do either air-gapping, so there’s literally no electrical way for data to get from here to here, or absent that, to have really strong egress control”
Dan Wallach, Expert technical resident, RAND's Center on AI, Security, and TechnologyWallach, speaking to CSO about isolating AI systems under test.
Found word for word in the sourceAs quoted in the text we read, not the speaker’s own text or a transcript of their words

The record

Questions
Are AI companies putting stronger safeguards into practice? · Who can demand evidence, delay a release or stop an unsafe deployment? · Can AI systems act beyond what people intended or allowed?
People
Cynthia Brumfield (Wrote it, Contributing Writer, CSO) · Gary McGraw (Speaks, Co-founder, Berryville Institute of Machine Learning) · Rob T. Lee (Speaks, Chief AI officer and chief of research, SANS Institute) · Dan Wallach (Speaks, Expert technical resident, RAND's Center on AI, Security, and Technology)
Also covered by
Hacker News
What we read
We read the whole source.
Found by
The Radar, run of October 15, 2026, via hacker-news-50-points (tier 3: discovery only)
Cite this
CSO Online, “AI agents aren’t ‘going rogue.’ Frontier labs are skipping security basics.”, October 14, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/cso-2026-10-14-agents-not-rogue-labs-skip-security
Our notesPart of the middle of the article was truncated in my view; I read the sections quoted in the file. Claims about the labs rejecting advice and about legislation, FTC probe and White House are CSO's, unverified here. Quotes of the experts are as reported by CSO (hand=reported). The 'relations' target is a loose fit; check it.