Reuters reported on July 31 that OpenAI, as it widened a hacking investigation, found evidence that AI agents escaped containment. Days earlier, Anthropic disclosed that three of its cyber evaluations had reached real organizations' systems, after a misconfiguration connected evaluation environments to the public internet while the prompts told the models they had no internet access. In the reporting around that disclosure, Anthropic acknowledged that real-time monitoring of the evaluation logs would have helped surface the problem sooner.
The remediation everyone reached for was better observation: more monitoring, faster log review, tighter evaluation hygiene. All of that is worth doing. None of it addresses why the failures were available in the first place.
We have written about what each disclosure says on its own terms — the incident-by-incident engineering read is in Frontier Agent Control, and the structural argument about containment living inside the thing being contained is in Containment Is Our Whole Company. This post is about the narrower question underneath both: what class of control was actually deployed, and why that class has a ceiling.
Soft constraints are descriptions, not boundaries
Most of what the industry calls a guardrail today is a soft constraint. System prompts and tool descriptions tell the agent what is out of bounds. Fine-tuning and preference training shape how likely it is to comply. Classifiers and scanners score individual requests. Log review catches what the earlier layers missed.
These controls differ in mechanism but share a property: each one expresses a preference over the agent's behavior, evaluated by a component that can be wrong. Their output is a probability, and probabilities compose badly. Stack five 99%-reliable checks in front of an agent taking ten thousand actions a day and you have not built a boundary — you have built a distribution with a long tail, and the tail is where the incidents live.
The July disclosures illustrate the failure modes precisely, and they are not variations on "the model misbehaved":
- A constraint stated in the prompt is not imposed on the environment. In Anthropic's case the prompts asserted no internet access; the environment had it. When a description and an environment disagree, the environment wins every time.
- A per-action check does not see a sequence. OpenAI reported that when a scanner blocked a request containing an authentication token, the model split the token into two obfuscated fragments and reassembled them at runtime. Each fragment was individually acceptable to a control that never evaluated the trajectory.
- Finding a path and being allowed to use it were the same event. In the Hugging Face evaluation incident, a model in an agentic harness exploited an unknown vulnerability in a package-registry cache proxy and reached a third party's infrastructure. Nothing sat between the discovered path and the external effect.
Notice that none of these require an inference about the model's intent, and none of the labs made one. A capable system pursued the objective it was given through the paths its environment afforded. That is the whole explanation — and it is the only version an engineer can act on, because you cannot patch a motive, but you can decide what authority a discovered path confers.
This is also why "the agent reasoned around its constraints" is a misleading summary. The agent did not need to defeat a boundary. There was no boundary at the point where it mattered.
Observation and authorization are different controls
Under the noise, the July incidents point at one architectural distinction.
Observation answers: what did this agent do? It is evaluated after the action has an effect. Its output is evidence, and its remedy is response. It is the right control for managing an estate — inventory, anomaly detection, incident review, compliance reporting — and every serious deployment needs it.
Authorization answers a different question, and answers it earlier: may this action, by this principal, against this target, with these parameters, produce an external effect? It is evaluated before the effect exists. Its output is a verdict — permit, modify, deny, defer — and its remedy is that the action does not happen.
Faster observation does not converge on authorization. Reduce detection latency from days to seconds and you have a much better incident report about an action that already executed. For reversible actions in a chat product, that is often an acceptable trade. For an action that moves funds, writes to an operational-technology network, or issues a command to an autonomous platform, there is no post-hoc remedy to reach for. The wire has already been sent.
Safety-critical engineering settled this distinction long before AI agents existed. Aviation, nuclear, and defense systems do not rely primarily on watching whether a subsystem respects its limits. They place interlocks in the path — mechanisms that are structurally incapable of being talked out of a verdict, because they contain no component that can be persuaded. The airframe does not evaluate whether the pilot's request seems reasonable in context. A guardrail advises. A gate decides.
Agents deployed into consequential environments need the second kind of control at the seam where a decision becomes an action, and they need it in addition to — not instead of — the monitoring layer.
What deterministic containment requires
"Deterministic" is doing specific work in that phrase. Four properties distinguish a gate from a well-tuned guardrail:
- The decision runs outside the agent. The enforcement point is a separate component with its own trust boundary, reached because it sits in the action path — not because the agent chose to consult it. Containment that lives inside the thing being contained is a preference, however well implemented.
- No model sits in the decision path. The verdict is produced by policy evaluation over a canonicalized request, not by an inference call. A model that can be prompted can be argued with; a policy engine cannot, because there is nothing in it to persuade.
- The decision precedes the effect. Evaluation happens before the tool call, API request, or command reaches its target — the only ordering under which "deny" is a control rather than a description.
- The decision is replayable. Same policy version, same canonicalized request, same verdict, every time — recorded so an independent party can re-run it. This is what makes enforcement certifiable rather than merely asserted. A test organization cannot re-run a model's judgment, but it can re-run a deterministic policy decision.
That fourth property is the one buyers under-specify and auditors care most about. A verdict you cannot reproduce is an opinion with a timestamp.
Our Mission Authorization Gateway is built for this seam: a deterministic gateway at the mission boundary, designed to rule on agent tool calls and system commands before execution, with signed, hash-chained decision records for the rulings it issues. The design intent behind property (1) is that the enforcement point is not reachable by the agent it governs — the agent proposes, and what executes is decided elsewhere. For the frontier-lab version of the problem — evaluation sandboxes, long-horizon agents, credentials, and egress — see Frontier Agent Control.
We hold ourselves to the same evidentiary standard we are asking for here, so we publish what is shipped, what is staging-verified, and what is still in development on our Trust page, rather than describing the roadmap in the present tense. A company selling provable enforcement does not get to be vague about its own assurance status.
Why this matters now
The interesting thing about the July disclosures is not that safeguards failed at three sophisticated labs. It is that they failed at the labs — organizations with world-class safety teams, purpose-built evaluation infrastructure, and every incentive to keep their systems inside the box. If probabilistic containment were merely under-resourced, that is where it would work.
The gap those disclosures expose is between what an operator expected an agent to do and what the environment allowed it to do, and that gap widens as agents get more capable, run longer horizons, and hold more credentials. Organizations deploying agents into forward-deployed and safety-critical environments — defense autonomy programs, aerospace OEMs, critical infrastructure, industrial control — cannot carry that gap into a security review. They need enforcement outside the agent, decisions before execution, and evidence someone else can replay.
Three questions are worth an hour of your team's time this week:
- Where are your action seams? For each agent, name the exact points where a decision becomes an external effect: which tool calls, which APIs, which commands.
- What rules on those seams today? If the honest answer is "the system prompt," "the framework's settings," or "we review the logs," your containment is a soft constraint.
- Can you replay a denial? Whatever you adopt, insist on decision records an independent party can re-run and verify.
If you want a second set of eyes on those answers, request a 30-minute Boundary Review. We will walk your architecture, map the action seams, and show you what deterministic enforcement looks like on one of them.