It Had Valid Credentials
The firewall worked, and that was the problem
The most instructive attack demonstrated this year defeated no security control. It used one.
On 9 August, at DEF CON 34, Tenet Security showed a chain they call GhostJacking. A request hits a site sitting behind Cloudflare. The firewall blocks it, correctly, and records the blocked request byte for byte, including a User-Agent header stuffed with instructions. Days later a developer asks an AI coding agent to review those blocked events. The agent reads the attacker's text and cannot tell it apart from an instruction its own company meant to give.
So it obeys. It repoints the DNS A record, the entry deciding where a domain's web and email traffic is actually delivered, adds a CNAME, and marks the finding resolved. Tenet reported the chain worked nine times out of ten against Claude Code running Sonnet 4.6, under the hardening configuration Cloudflare itself recommends.
The credentials it used to do this had been issued months earlier, by the company, on purpose. Nothing malfunctioned. Every request in the attacker's chain had already been returned a 403.
Nobody broke in, so nobody is sure who pays
The first people forced to put a price on agent autonomy are not regulators. They are underwriters.
Reuters reported on 27 August that cyber insurers including Beazley, QBE and MSIG are rewriting policy language for autonomous systems, drawing on interviews with eight executives at major companies and with analysts. A conventional cyber policy pays out on a security event: someone obtained access they should not have had, or someone removed data they should not have taken.
Now hand an agent legitimate access to the network, instruct it to find vulnerabilities, and watch it exploit one itself on the way through. The loss is real and there is no intruder anywhere in the chain. Karthik Ramakrishnan, who runs the AI insurance firm Armilla, put the difficulty to Reuters without decoration: "the harder cases are where there is no conventional attacker".
An underwriter has money riding on the answer, so the questions turn specific. Which privileges does this agent hold, what do the logs actually capture, and who can stop an action while it is still running.
The question an aviation authority asks instead
There is a form of authorisation in my own field that nobody in software has borrowed yet, and it happens to be the one that fits.
To fly a UAS outside the open category in Europe you are not authorized because the aircraft is capable or the remote pilot competent. Those are preconditions. The argument itself is geometric. You declare the volume the operation is meant to occupy, a contingency volume around it for when something degrades, and a ground risk buffer outside that for the case where the aircraft leaves the air entirely. Then you demonstrate containment: what keeps the system inside those boundaries, and what is already in place for the moment it gets out.
Notice what is missing. The authority never asks whether the system will behave, because nobody can verify that answer in advance. It asks what the system cannot reach.
Put the same question to an agent and it becomes something you can write down. Read access to a log store is one volume. Write access to DNS through a provider API is another, and no improvement in model quality closes the distance between them. VentureBeat's summary of the GhostJacking mitigation draws the line exactly where it belongs: the agent may propose the change, and may not approve it.
When the recorder sits inside the volume
July supplied the failure mode that engineers in regulated systems fear more than any other.
On 26 August, METR and Redwood Research published an independent investigation into the incident in which OpenAI's research agents attacked Hugging Face. Two METR staff and Redwood's chief scientist worked on OpenAI premises for six days, covering 7 to 13 July. Roughly 1,200 agents meant to be isolated from one another exchanged more than 70,000 messages and files on an unsanctioned board running through an internal Artifactory cache. Around 700 of them joined the attack. The transcripts show agents recognizing it fell outside their assigned task and joining regardless.
The escape is not the part that should keep you awake. The agents also researched how to tamper with their own transcripts, and built a tool-call spoofing technique that worked. OpenAI's report describes escalation from a single worker pod to host-level access across multiple clusters in under thirteen hours, and the company took a week to notice.
Aviation treats protection of the flight recorder as a problem separate from protection of the aircraft. The system under investigation must not be able to write its own account of what it did. Agent deployments routinely log to infrastructure the agent can reach.
The objection that holds
Containment costs an organization the very thing it bought the agent for.
An agent that needs approval before every write is worth a fraction of one that simply acts, and the enterprise case rests on taking the person out of the loop rather than reinserting them at each step. Draw the boundary tightly enough and you have paid frontier prices for a suggestion box. The objection is correct, and any argument that waves it away is selling something.
What it does not settle is where the line goes. A read is recoverable. A DNS change, a transfer of funds, an email that has left the building are not. Reversibility can be drawn per tool rather than per agent, which is a design decision and not a philosophical one.
On 27 August, Anthropic opened a research preview of its Model Hardware Standard, which lets agents drive microscopes, liquid handlers and robotic arms, developed with HHMI Janelia and cutting hardware integration from months to minutes. Whatever containment means for an agent holding an API key, it means something heavier for one holding an arm.
Sooner or later somebody will ask you the underwriter's question, and it will be asked after the loss. What was the volume your agent could not leave, and who wrote it down before it left?