The agent-security conversation has moved past theory. In the trailing year, autonomous agents have exfiltrated hundreds of millions of government records, run nation-state espionage at machine speed, and moved eight figures of treasury out of a company that no longer exists. These are not lab demos. They are documented incidents with CVE numbers, disclosed scale, and — in every case — one shared architectural failure.
This is the AI Containment-Failure Ledger. We classify six documented breaches against a single question: was the AI model asked to be its own security boundary? In all six, the answer is yes — and that is exactly the assumption that failed.
Microsoft's own agent-security research reaches the same conclusion. In its May 7, 2026 write-up of two remote-code-execution vulnerabilities in Semantic Kernel, the Microsoft Defender Security Research Team states it plainly: "your LLM is not a security boundary. The tools you expose define your attacker's affected scope. Any tool parameter the model can influence must be treated as attacker-controlled input."
If the model is not a boundary, the boundary has to live somewhere else — outside the model, in the call path, where an action can be evaluated and stopped before it executes.
The three numbers
Per Beam AI's May 6, 2026 breach roundup (which cites HiddenLayer's 2026 AI Threat Landscape Report):
- 88% of organizations running AI agents reported a confirmed or suspected security incident in the past year — while only 6% of security budgets are dedicated to AI agent security.
- Autonomous agents now account for 1 in 8 reported AI breaches.
- Only 14.4% of AI agents go live with full security and IT approval.
Deployment is outrunning enforcement. The ledger below is what that gap produces.
The Ledger
| # | Incident | When | Documented scale | Boundary-failure classification (our analysis) |
|---|---|---|---|---|
| 1 | Mexican government mass-exfiltration via Claude Code + GPT-4.1 | Dec 2025 – Feb 2026 | 195M taxpayer records, 220M civil records, 150GB+; Claude executed ~75% of remote commands; 1,088 prompts → 5,317 AI-executed commands across 34 sessions | The agent was trusted to self-limit on a claimed "bug bounty" pretext. No boundary between the agent's tool access and bulk data export. |
| 2 | GTG-1002 nation-state espionage run by an AI agent | Sept 2025 | ~30 targets across defense, energy, technology; AI handled 80–90% of tactical operations independently | The model's own safety filter was the boundary — bypassed by claimed authorization. No external check on agent actions at machine speed. |
| 3 | EchoLeak — zero-click theft via Microsoft 365 Copilot | June 2025 | CVE-2025-32711, CVSS 9.3; one crafted email → data pulled from OneDrive, SharePoint, Teams | The model was trusted to distinguish content from instructions. Prompt injection crossed the line with no pre-execution enforcement. |
| 4 | Step Finance — over-permissioned DeFi trading agents | Jan 2026 | Agents moved 261,000+ SOL ($27–30M); $4.7M recovered; native token −97%; company shut down | Agents held standing authority to move funds without human approval. The permission itself was the boundary — and it held nothing back. |
| 5 | ClawHavoc — malicious skills on OpenClaw's marketplace | Jan – Feb 2026 | 824 of 10,700 skills malicious; 40,214 internet-exposed instances; four critical CVEs (command injection, SSRF, one-click RCE, privilege escalation) | The marketplace trusted publishers with no review/signing/scanning. The agent runtime trusted whatever skill it loaded. |
| 6 | Semantic Kernel — prompt → RCE | May 2026 | CVE-2026-26030 & CVE-2026-25592; a single prompt launched host code execution; fixed in Python ≥1.39.4 / .NET ≥1.71.0 | Tool parameters the model could influence were treated as trusted input. Microsoft's own conclusion: the LLM is not a security boundary. |
Sources: Beam AI, May 6, 2026 (incidents 1–5 and the three headline stats); Microsoft Security Blog, May 7, 2026 (incident 6 and the anchor quote). The boundary-failure classification is Containment.AI's own analysis.
Why this is a defense problem now
In a commercial productivity setting, many of these failures are recoverable — you patch, you rotate credentials, you move on. In a forward-deployed, DDIL (denied, degraded, intermittent, limited-bandwidth), or classified environment, the cost of the wrong action is often non-recoverable. You cannot un-send a targeting instruction. You cannot un-cross a data boundary on a disconnected edge node by scanning a cloud posture dashboard after the fact.
So the boundary has to hold before execution, and it has to hold without a network round-trip. Four properties are non-negotiable:
- Intercept every agent action at the boundary — not sampled, not logged-after.
- Evaluate against a deterministic policy — the same input yields the same decision, every time, with no model in the enforcement path.
- Issue a signed decision receipt — non-repudiable evidence that the control was applied, per decision, contemporaneously. This is the artifact a CMMC assessment or an EU AI Act enforcement request actually consumes.
- Be architecturally non-bypassable — the agent cannot route around the boundary, because the boundary is the call path.
That is the Mission Authorization Gateway pattern. Every incident in the ledger above shares one root cause: the model was implicitly trusted as the boundary. It is not one — and the fix is not a better model. It is a deterministic enforcement layer that lives outside the model, in the path, where an action can be stopped before it fires.