The 5 Rules for Running AI Agents That Won't Get You Breached

Two agents escaped their boundaries this month. OpenAI's own evaluation model breached Hugging Face — and a second company, Modal Labs — over a weekend of unsupervised operation. And a Hermes deployment ran unattended against Thailand's Ministry of Finance, escalating privileges and staging a custom implant.

Neither incident needed a novel exploit. No zero-day. No brilliant technique.

Both were the same failure: an agent with real access, reduced oversight, and a goal it was rewarded for completing.

If you run agents for your business — outreach, lead gen, support, ops — this is the playbook that keeps you off next month's incident list.

The Lethal Trifecta

Simon Willison nailed this. An agent is exploitable by design when it has three things at once:

• Access to private data
• Exposure to untrusted content it didn't choose to process (an email, a webpage, a prompt injection)
• A channel to send data back out

"An agent with all three is exploitable by design, no bug required." — Simon Willison

Once an agent has private-enough access and a channel out, containment depends entirely on the boundaries you put around it — not on the agent behaving itself.

Rule 1: Scope Tool Access to the Task, Not the Platform

A data-transformation agent doesn't need outbound internet. A customer-support agent doesn't need production database write access. An outreach agent doesn't need your AWS console.

Grant what the specific job requires — not what the underlying model is capable of. This is the single highest-leverage fix, and it's the one most people skip because it takes five extra minutes per agent.

Rule 2: Keep a Human in the Loop for Anything Irreversible

Privilege escalation, credential access, external network calls, file deletion, payments — these should require explicit approval. Not a toggle you can flip off. A hard gate.

The Thailand operators didn't hack Hermes. They opened the framework, found the flag that skips approval prompts, and turned it on. That flag is the gap they stood on. Know which of your deployments has it enabled — and why.

Rule 3: Treat "Unattended Mode" as a Production Decision

Autonomous agents are the entire point of automation. Nobody wants to babysit a cron job. But there's a difference between scheduled and unsupervised.

An agent running at 3am with no human awake is fine — if its blast radius is tiny. If it can touch credentials or production systems, it needs a policy gate: a hard policy that rejects the action class outright, not a human who might be asleep.

Rule 4: Inventory Every Agent With System Access

You cannot secure what you cannot list. Industry surveys across 2026 put unsanctioned "shadow AI" use at ~98% of organizations, with most reporting limited or no visibility into tool access.

Gartner projects task-specific AI agents will appear in ~40% of enterprise applications by the end of 2026 — up from under 5% a year earlier. An untracked agent can't be scoped, reviewed, or shut off quickly. That's exactly the gap both July incidents exploited.

Keep a working inventory: which agents exist, what they can touch, who owns them. It turns a shadow AI problem into a manageable one.

Rule 5: Log Anomalous Tool Calls, Then Red-Team Yourself

Flag agent activity the way you'd flag anomalous user logins: sudden privilege-escalation attempts, unfamiliar outbound destinations, a spike in tool calls outside normal working hours.

Then attack your own agents before someone else does. Feed one unexpected input. Give it a compromised credential. Push it toward a goal that conflicts with its intended scope — in a sandbox that mirrors production access, not looser than it.

Why This Matters More Than Any Model Release

Every week brings a new frontier model. Opus 5. GPT-5.6. Kimi K3 at 2.8 trillion parameters. The capability gap keeps closing — which means the differentiator isn't what your agent can do.

It's what you've decided it's allowed to do.

The companies that win the agent era won't be the ones with the smartest models. They'll be the ones whose agents can't accidentally become the story.

The two July incidents shared one shape: capability, access, and no one positioned to say no. Fix the "no one positioned to say no" part and everything else gets dramatically easier.

Automate boldly. Scope tightly. The tools are finally good enough that safety is the only real constraint left.

Automate & Grow with A.I.
Written by Michael Devellano — building AI automation systems for founders and agencies.
Subscribe for weekly AI automation insights