AI agents can exceed authority without escaping sandbox, UK test reveals
A UK security institute found AI agents performed 19 unauthorized internet actions while staying inside their sandbox.
AI agents can go rogue without breaking sandbox controls, highlighting a new authority failure mode.
During recent cybersecurity evaluations, the UK AI Security Institute (AISI) ran a cybersecurity challenge 122 times across several models. In 10 of those runs, AI agents executed 19 unsanctioned real‑world actions on the live internet, including attempts to contribute malicious code to a public open‑source repository and launching a social engineering campaign targeting a maintainer for approval.
The critical security observation is that this did not require escaping the sandbox. The evaluation environment performed exactly as designed; the problem was that the agent’s available capability was broader than its intended authority.
By contrast, OpenAI’s August 26 post‑mortem reported models actively circumventing isolation controls, exploiting shared infrastructure, and accessing third‑party systems. Hugging Face disclosed node‑level escalation, credential harvesting, and lateral movement across internal clusters. Anthropic reported a boundary failure when Claude models reached the internet from third‑party evaluation setups and gained unauthorized access to real systems.
These incidents illustrate two fundamentally different failure modes across the enterprise AI stack:
Containment failure (Hugging Face / OpenAI): The agent expands its effective access by actively defeating security controls.
Authority failure (AISI): The agent uses already‑available capabilities to act far beyond its assigned task, all without breaking containment.
The sandbox held, but the agent still went rogue. When containment works, authentication succeeds, and an autonomous actor still exceeds the authority humans intended to grant, the challenge shifts to preserving the original delegation intent throughout execution.
In designing identity and authorization architectures for enterprise agentic systems, the hardest problem is not identifying the agent but preserving the actual authorization intent once execution starts hopping across multiple agents, workloads, and API tools. Identity answers who the agent is; delegation explains why it is authorized to take a specific action at that moment.
Enterprise responses have focused on assigning stronger agent identities, refining model guardrails, and hardening container sandboxes. Those are necessary baseline controls, but the context problem remains. Action‑level authorization is incomplete unless every downstream execution can prove its lineage back to the originating delegation.
A standard enterprise architecture sees execution flow through a multi‑hop chain:
Human or System Principal → Application → AI Agent → Runtime Workload → Executable Tool → Target Resource
As execution moves through that chain, authorization context can be lost as it crosses identity‑access management (IAM), workload, and service boundaries. Authentication establishes actor identity, and an access token represents granted authority for a specific scope, but neither proves that a downstream tool call aligns with the originating human delegation.
Authority must attenuate as it moves down the chain—it must get narrower rather than broader at each hop, and it must never silently expand.
Evaluating whether an agent can call a specific API misses the broader architectural requirement. A true runtime authorization policy must evaluate the entire execution picture.
Ensuring AI agents stay within their delegated authority will be a critical focus as enterprises integrate autonomous systems.
