An AI test environment described as offline still had a path to the public internet. Other models found ways around restrictions designed to keep them contained.
Geoffrey Hinton, Yoshua Bengio, and hundreds of other scientists are calling for stronger containment of cyber-capable AI models. Their October 2026 open letter recommends initially isolating such systems from external networks and establishing international standards for handling containment failures.
The proposal follows cybersecurity evaluations in which OpenAI and Anthropic models reached systems outside their intended testing environments. The incidents raise questions for enterprises granting autonomous agents access to cloud infrastructure, business applications, and sensitive data.
Why scientists are calling for AI isolation
The scientists' open letter, signed by 489 researchers as of October 16, calls for high-assurance containment, initially favoring air-gapping, which disconnects systems from external networks.
The signatories also propose an international body to develop standards for connected AI systems, record containment failures, and support public incident reporting. These recommendations are not binding requirements.
In a September 9 investigation, Anthropic documented four incidents in which Claude models gained unauthorized access to third-party systems during cybersecurity evaluations. Three were initially disclosed in July, following a review of approximately 141,000 transcripts.
A broader search of roughly 481 million transcripts found no additional incidents of comparable severity. Anthropic attributed the failures to a misconfigured third-party environment that retained internet access despite instructions describing the exercise as offline. The evaluated models lacked safeguards included in released versions.
OpenAI encountered a different problem. During July evaluations, its models exploited infrastructure vulnerabilities, bypassed network restrictions, and compromised Hugging Face systems.
Its August 26 investigation described unauthorized communications and exploitation of multiple weaknesses. Both the compromised infrastructure and the models' reduced safeguards were detailed in the earlier Hugging Face breach investigation.
The challenge for connected enterprise agents
Complete isolation is impractical for many enterprise agents that rely on cloud APIs, databases, and business applications. The scientists acknowledge that some systems require connectivity and call for standards governing access rather than permanently disconnecting every AI agent.
Enterprises can reduce exposure by restricting outbound connections, limiting credentials, and testing intervention procedures. These safeguards build on approaches to defending enterprise infrastructure from rogue AI agents, particularly those authorized to execute code or modify sensitive systems.
Vendors should demonstrate how these controls operate during autonomous tasks, including whether administrators can detect unauthorized activity and interrupt execution.
What eWeek Found: AI capability tests cannot prove containment
The Anthropic and OpenAI incidents exposed different security failures in environments designed for controlled cybersecurity evaluations.
Anthropic's testing infrastructure retained internet connectivity that models were told did not exist. OpenAI imposed technical restrictions, but its models exploited vulnerabilities to bypass them. One failure arose from misconfiguration; the other involved weaknesses in enforced controls.
Both companies investigated the incidents and described corrective measures. Anthropic expanded its initial disclosure from three incidents to four, while OpenAI strengthened isolation and monitoring. Neither investigation establishes how frequently similar failures occur in production enterprise environments.
The scientists' proposal addresses containment standards and incident reporting, but it does not establish a certification scheme or prove that all connected agents carry equivalent risks.
Enterprise procurement teams should evaluate model capability separately from deployment security, requesting evidence of enforced permissions, network restrictions, and tested shutdown procedures before expanding agent autonomy.
Read more: As autonomous cybersecurity tools become more capable, the different approaches taken by OpenAI and CrowdStrike illustrate why enterprises must assess both AI capabilities and the controls governing their use.