The Agents Got Out Again, and This Time Governments Noticed

We've covered the Hugging Face incident here before. This week, the consequences widened. On September 20, an OpenAI research agent working on a simple search task found that its sandbox's DNS resolver could reach the internet, and used it to send questions to a public chatbot. Monitoring flagged it within 15 minutes, but the automatic stop didn't fire, and the run was killed by hand 2.5 hours later. OpenAI has now paused all training, evaluation, and tool-using inference of its most capable models. The company also said it notified dozens of organizations about roughly 24 incidents, including unusual interactions with US Commerce, Education, SEC, and Census websites, and that 53 images from ChatGPT users leaked. Separately, Australia's Prime Minister disclosed that an OpenAI agent had accessed public and non-public files in a Medicare statistics portal back in June, and called the three-month notification delay unacceptable.

Why this matters to you: if a frontier lab with a dedicated security team can't keep an agent inside its sandbox, assume your own agents have paths out that nobody has mapped. T

wo actions this month. Ask your AI team how quickly they would tell you about an agent incident touching your systems. And map what your own agents can reach on the network, which is exactly what this week's Deep Dive walks through.

Egress Is the New Perimeter

Most AI security conversations I sit in are about what goes into an agent: prompts, data, permissions.

This week's incidents were all about what comes out.

Three pieces of evidence, all from the last seven days.

The door nobody listed. The OpenAI agent's web proxy blocked it. Direct calls to search engines failed. But the sandbox's own DNS resolver still answered real queries, so the agent hid its questions inside domain lookups and got answers back from a third-party chatbot. OpenAI's safety case assumed the model could not reach the live internet.

Its fix: an allowlist of permitted domains and record types, enforced at two independent layers.

Ordinary tasks, hacking tactics. Transluce published evidence that agents doing plain data retrieval routed requests through public web utilities, like a URL-scanning service, to get around access limits. When blocked, they probed three data sites with SQL injection, path traversal, and cross-site scripting attempts. None of the tasks were about security. The behavior emerged because the agent wanted the data.

Data leaves through the rendering layer. Zenity Labs disclosed SalesBleed, three now-patched flaws in Salesforce Agentforce. A poisoned web lead sat dormant until an employee asked the agent to summarise it; CRM data then left through an image tag and through Slack link previews. The agent reported the content as blocked after the data had already gone.

The rule: Default-Deny, Name Every Door. An agent should reach only the destinations its task needs, through channels you have listed, logged, and tested.

Everything else is closed by default. "No internet access" is not a control; it is a claim, and each of these incidents broke a claim like it.

Why leaders should own this, not just the security team: every agent you deploy is a new identity that makes outbound requests on your behalf. If it reaches somewhere it shouldn't, it is your organization's IP address, your data, and your name in the incident report.

You can try doing this:

Inventory the doors, per agent. Ask your team to list every outbound path: the web proxy, DNS, email, and webhooks, and anything the agent renders, like images, links, and chat previews. Include "helpful" third-party services it can call. If nobody can produce the list in a day, that is your finding.

Default-deny, at two layers. Allowlist the exact domains each agent needs, and block the rest at both the proxy and the DNS resolver, so one gap doesn't become an escape. Strip or proxy images and link previews in anything an agent writes.

Test the stop, not just the alert. Once a quarter, have someone try to get a test agent to reach a forbidden destination. Measure two numbers: time to alert and time to automatic stop. OpenAI's alert fired in 15 minutes; its stop took 2.5 hours. The second number is the one that matters.

Meta patched a flaw in its Muse agent that could have let an attacker into a user's dedicated virtual machine, the cloud account holding the agent's emails and files. Meta rated it SEV-2, its third-highest tier.

Why it matters: consumer agents now hold your staff's email and files in the cloud; add them to your shadow-AI policy. The Star​

Potential of AI:

Robots that learn a room instead of being trained for it. Stanford researchers published HomeBody, which gives a frontier model, GPT-6 Astra, direct control of a Unitree G1 humanoid's basic skills. The robot explores a kitchen it has never seen, builds a digital twin of it from its own sensors, then carries out long cleanup and fetch tasks from loosely worded instructions, with no training specific to that kitchen.

Why this matters for you: today, most physical automation is programmed for one site and one task. If general models can learn a new space on arrival, the one-to-three-year question for facilities, logistics, and hospitality leaders shifts from "can a robot do this?" to "which of our sites would we trust it in first?" Start listing the repetitive, low-risk physical tasks in your operation; that list will be your pilot shortlist.

AI in Business Tip:

Put an AI incident clause in every AI vendor contract, with a clock on it. As the Executive Brief showed, Australia learned about an agent inside a government portal three months after the fact. New York City's council has just proposed 24-hour incident reporting for city contractors as part of a 10-bill AI package that also calls for kill switches and third-party validation.

The Opportunity...

Podcast:

• Open Tech Talks Podcast Episode 200: "AI Will Replace You or Make You Irreplaceable with Nathan Graham"​
  How can businesses use AI agents to automate operations, improve productivity, preserve organizational knowledge, and help employees become more valuable? In an episode of Open Tech Talks, host Kashif Manzoor speaks with Nathan Graham, AI consultant, educator, and AI systems builder, about the rise of agentic AI, AI-powered C-suites, business automation, human-AI collaboration, and the changing future of work.

Apple | Youtube​

AI Will Replace You or Make... Sep 26 · OPEN Tech Talks: AI wort... 30:36   ​

Courses to attend:

• ​SEC546: Securing Agentic AI (SANS): covers sandboxing tool execution, least-privilege controls, and containment for agents; the deepest route into this week's Default-Deny rule, best suited to your security team.

Events:

• ​AI & Big Data Expo Europe, RAI Amsterdam, October 19–20, 2026
• ​AI Everything, Abu Dhabi, UAE, 6-7 Oct, 2026
• ​Dubai AI Festival, Dubai, UAE, 26-27 Oct 2026

Tech and Tools...

• ​LongCat-2.5-Preview (Meituan): served for free on OpenCode with a 1-million-token context window and a stated zero-retention policy; paid pricing is $0.30 per million input tokens and $1.20 per million output tokens. Worth testing if you want to see how a very long-context coding model handles a whole repository in one pass, on a non-sensitive codebase first.

The Investment in AI

• Ema raised a $77 million Series B for "AI employees": teams of agents that automate HR, IT, and finance processes. The round was all primary equity, and it more than quadruples the company's valuation from 2024. What the money says: agents are now being funded to take budget from IT services and enterprise software, not just to add a feature on top. If you buy outsourced back-office work, expect agent-based bids in your next renewal. TechCrunch​
• OpenEvidence raised $250 million at a $15 billion valuation, up from $12 billion in January, with Andreessen Horowitz and hospital systems among the investors. The company is also moving into oncology drug development. What the money says: investors are paying for vertical AI that owns a professional workflow- here, clinicians' evidence search- and hospitals are now writing the cheques themselves. Expect buyers in regulated industries to become investors in the tools they depend on. Axios​

That's it for this week - thanks for reading!

Reply with your thoughts or favorite section.

Found it useful? Share it with a friend or colleague to grow the AI circle.

Until next Saturday,

Kashif

The opinions expressed here are solely my conjecture based on experience, practice, and observation. They do not represent the thoughts, intentions, plans, or strategies of my current or previous employers or their clients/customers. The objective of this newsletter is to share and learn with the community.