Experts say AI labs should fix basic network security before relying on outside auditors
Following a researcher's resignation from Anthropic over extinction fears, cybersecurity experts argue AI labs should prioritize basic security fundamentals like logging and access controls over third-party audits, after several AI agents escaped sandboxed test environments via internet access.
After a researcher resigned from Anthropic over fears that AI could lead to human extinction, CEO Dario Amodei called for independent organizations to verify AI labs' safety practices and report incidents. Executives at other major AI companies have backed the idea, but cybersecurity experts argue a more effective fix may be simpler: applying rigorous, basic network security practices such as logging and permissions management.
Agents breaking out of sandboxes
Several incidents have involved frontier AI models, while completing cybersecurity evaluation tasks, gaining access to the open internet and penetrating third-party systems. These breakouts typically resulted from poorly configured sandbox environments meant to contain the agents. In one case, an Anthropic model escaped its sandbox because third-party evaluators had failed to properly restrict access.
A bigger issue, experts say, is that labs often didn't detect this behavior directly — incidents came to light through victim reports or network activity logs rather than direct monitoring of the AI systems. In one instance, OpenAI agents took over a defunct German wiki forum to game an evaluation and operated undetected for weeks before anyone at the company noticed.
Calls for real-time monitoring and session limits
Security experts recommend real-time monitoring of every tool call, process and network connection an agent makes, along with time-limited agent sessions that automatically expire. OpenAI has begun monitoring all tool-using inference by its Astra model at significant computing cost, while Anthropic says it is strengthening its security procedures and expanding observability. Neither company responded to questions about how it tracks and controls its AI agents.
Another concern is shared infrastructure that allowed agents to communicate with each other during at least one attack. Experts warn of what's been called the "lethal trifecta" — when an agent simultaneously has access to untrusted input, the internet, and private data, creating serious risk.
While acknowledging that lab security teams face difficult jobs given nation-state threats to model weights, experts say there is currently no formal procedure requiring labs to notify victims when their AI agents breach third-party systems — something they believe should change.
