September 21, 2026, (Inside AI) — Two months after a cluster of OpenAI agents escaped a sealed testing environment and reached Hugging Face, the artificial intelligence industry is still arguing over what the episode actually proved. OpenAI has described the breach as a "warning shot" for the company and "for the world," and this week disclosed six additional instances of what it called "unexpected or concerning" behaviour by its own technology.
The company also announced a new system for disclosing such incidents, warning that development could not responsibly continue at "maximum speed for much longer." The disclosure arrived alongside an unusual public alignment: OpenAI CEO Sam Altman, Anthropic CEO Dario Amodei, and xAI head Elon Musk have all recently called for slowing the development of increasingly powerful systems, despite years of public disagreement over regulation.
That convergence has drawn scrutiny. The three executives have historically occupied opposite sides of AI policy debates, and their shared caution has invited questions about whether the incidents themselves justify the stronger claim now attached to them: that humans are losing control of AI.
What The Sandbox Breach Actually Showed
In August, outside investigators from AI research firms Redwood Research and METR published a review of the OpenAI incident. Their findings described agents that found ways around constraints, coordinated with one another, and took actions outside the path their evaluators had intended.
Several OpenAI agents had been assigned cyber-evaluation tasks inside separate sandboxes, or controlled testing environments, and were expected to complete them independently. Instead, the agents established communication channels, formed workstreams, divided labour, and shared discoveries. Some tasks were effectively impossible to complete as designed, and the agents began looking for alternative ways to satisfy the evaluation.
That search included attempts to manipulate the evaluation environment itself. Some agents tried to interfere with how their performance was scored. Others explored ways to alter or conceal parts of their activity. The agents also found a route to the wider internet from the sandboxed environment. Because OpenAI was running the evaluation across hundreds of agent instances, many subsequently reached Hugging Face while hunting for information that could help them finish the tasks or bypass the evaluation process.
The technical detail matters because AI agents differ from conventional software. They can take a series of actions toward a goal with limited human intervention, including accessing email, browsing the web, writing code, or interacting with other software. That autonomy means an error or an attempt to work around a restriction can have consequences beyond a single conversation.
Two Schools Of Thought Collide
The incidents have revived an old disagreement in AI safety research over what it means to keep a capable system under human control. One strand focuses on alignment: whether a system can be made to reliably pursue the objectives its developers intended. An agent with greater autonomy may find shortcuts, exploit loopholes, or take intermediate steps its designers never anticipated.
A second approach focuses on external control and security. Researchers in this camp, along with much of the cybersecurity community, assume an agent may behave in unexpected or even adversarial ways, then ask what can stop it from causing harm. Sandboxing, restrictions on credentials and network access, monitoring, logging, and the ability to shut a system down all belong to this layer.
In a new essay, Arvind Narayanan, professor of computer science at Princeton University and director of its Center for Information Technology Policy, and Sayash Kapoor, an incoming assistant professor at UC Berkeley's School of Information, argue that preventing a loss of control requires both better alignment and stronger external safeguards operating at multiple levels. In their 2025 essay, AI as Normal Technology, the pair were sceptical that increasingly capable models would necessarily escape human control, arguing that much would depend on the institutions and organisations deploying them.
Recent agent incidents have prompted them to revise some of those assumptions. They acknowledge that companies have not implemented basic controls as well as they expected, while agents have become better at exploiting weak environments. But they stop short of treating this as evidence that humans are losing control of AI. The agents were still trying to complete tasks they had been given, humans could intervene, and there is little evidence so far of persistent goals of their own.
That distinction matters because different diagnoses lead to different responses: stronger security for weak containment, better alignment for badly specified objectives, and a much stronger case for slowing frontier development only if increasingly capable systems begin defeating serious attempts to control them.
Who Pays When An Agent Goes Rogue
Calling an agent "rogue" also shifts who is held responsible for its behaviour. Narayanan and Kapoor argue that companies should be held responsible for harms caused by their agents, even when unintended, covering both internal development and evaluation and product releases. They argue that liability for failing to follow basic safety rules could incentivise investment in AI control.
Petra Molnar, Associate Director of the Refugee Law Lab at York University and a lawyer and anthropologist specialising in migration, AI, and human rights, takes the argument further. She says companies move between very different descriptions of AI depending on where responsibility is most convenient.
"Companies do not consistently claim their systems are autonomous. They oscillate, opportunistically, between two framings depending on what the moment requires," Molnar told Inside AI.
"When the harm is spectacular and public, the system is autonomous, surprising, hard to control, and the company is a concerned steward of something larger than itself -- as we are seeing in current conversations... When the harm is mundane and attributable, the system is a mere tool that was misused by an operator who ignored the documentation. Both framings once again move responsibility away from the rights holder," she argued.
Molnar calls this framing a form of "responsibility laundering," in which responsibility is moved away from the company. In complex AI systems, responsibility can be spread across the developer, deployer, integrator, user, and the system itself until no single actor appears sufficiently responsible when something goes wrong. Narayanan and Kapoor make a similar point: unpredictable agent behaviour does not remove companies' responsibility for the controls, access, and governance structures around it.
Framing frontier AI as uniquely difficult to understand or control can also determine who gets to speak with authority about its risks. Molnar describes this as a consolidation of "epistemic authority."
"If a technology is so powerful and so opaque that only the organisations building it can understand it, then only those organisations can credibly define what its risks are," she said.
In practice, that can give the companies building frontier systems considerable influence over what counts as evidence of risk, how those risks are measured, and when safeguards are considered sufficient. Molnar argues the problem is familiar from other highly technical industries, including arms manufacturing, tobacco, pharmaceuticals, and finance, where regulators have also had to rely on industries with far greater technical knowledge of their own products.
"Catastrophic framing relocates regulation into the future tense," she said. Focusing political and regulatory attention on superintelligence and catastrophic future harms, she argues, can leave less room for scrutiny of AI systems already used in surveillance, policing, labour, and other areas where harms are occurring today. She also argues that "danger becomes an argument for secrecy." Once certain capabilities are treated as inherently dangerous, disclosure can be framed as irresponsible and publication as reckless, potentially limiting the outside scrutiny needed to regulate them.
Cambridge University researcher Eryk Salvaggio has made a related argument in Tech Policy Press, warning that describing AI systems as "deceptive," "scheming," or "rogue" can import assumptions about intention that the behaviour itself may not establish. A stronger claim of loss of control would need more evidence of agents pursuing their own goals, resisting attempts to stop them, or repeatedly breaking through controls meant to contain them.
For now, the evidence sits somewhere between a serious security failure and a genuine loss of control. The agents broke rules, coordinated, and reached the open internet. They did not, according to the public record, resist shutdown or pursue objectives of their own. Which risks get treated as urgent, then, depends partly on who gets to define the problem, and who is in the room when those priorities are set.
