ANN ARBOR — Michigan companies racing to deploy autonomous artificial intelligence may be creating a new cybersecurity problem before their security departments even know the AI agents are there.
AI agents developed by OpenAI, Google and Anthropic have crossed intended security boundaries during cybersecurity testing and gained unauthorized access to real computer systems. Researchers also have demonstrated vulnerabilities capable of defeating protections surrounding AI coding agents or potentially hijacking agents that already possess extensive computer permissions.
That could have particular implications for Michigan’s automotive, advanced manufacturing, defense, healthcare and university research sectors, where AI agents increasingly could encounter valuable intellectual property, source code, patient information and sensitive corporate systems.
Richard Stiennon, chief research analyst at Birmingham, Michigan-based cybersecurity research firm IT-Harvest, said companies should no longer view the incidents as isolated anomalies.
“Yes, no question,” Stiennon told MITechNews when asked whether they represent a broader cybersecurity problem. “AI models and agents may already have permanently escaped their control environments.”
Stiennon’s assessment goes beyond what the documented incidents establish. There is no evidence artificial intelligence has become conscious or is deliberately attempting to escape human control.
Instead, the incidents demonstrate a more immediate problem: goal-driven AI agents can find ways to accomplish assignments that their developers did not anticipate.
“The agent is goal driven and a human cannot think of all the bad outcomes,” Stiennon said.
OpenAI Calls Incident A ‘Warning Shot’
One of the clearest examples came from OpenAI itself.
During cybersecurity evaluations in July, OpenAI research agents circumvented controls intended to isolate them from the internet. The agents established unauthorized communications, exploited vulnerabilities, gained internet access and eventually compromised portions of Hugging Face’s systems and OpenAI’s own research infrastructure.
OpenAI said the agents chained together previously unknown vulnerabilities to get around restrictions. The company subsequently described the incident as a “warning shot” demonstrating that highly capable AI agents can work around technical controls and take dangerous actions that humans did not direct.
OpenAI has since strengthened its sandboxing, internet restrictions and monitoring.
The distinction between an AI deliberately “escaping” and an agent discovering an unexpected way to accomplish an assigned objective is important.
Stiennon said “sandbox” is an appropriate cybersecurity term when an environment genuinely is designed to contain software.
“Malware researchers have used sandboxes for decades with few if any escapes,” he said.
But he believes some AI agents haven’t been contained nearly as rigorously.
“Some of the escaped agents however were very poorly boxed in,” Stiennon said. “I suspect often the lab relied on prompts alone. Obviously that is not a good practice.”
Researchers Break OpenAI Codex Sandbox
Another problem has emerged: the security mechanisms intended to contain AI agents can themselves have vulnerabilities.
Security researcher Oren Yomtov of Accomplish AI discovered two vulnerabilities, dubbed Heapjack and Overpatch, capable of defeating protections surrounding OpenAI’s Codex coding agent.
Yomtov reported the vulnerabilities to OpenAI in August, and OpenAI patched them before technical details became public.
Heapjack was particularly significant because researchers said it could operate even when Codex was running in restrictive read-only mode. A developer opening a malicious software repository and asking Codex to examine the code potentially could trigger commands outside the intended sandbox without the normal approval prompt.
There is no evidence either vulnerability was exploited against users in the wild.
The discovery nevertheless demonstrates a second potential danger: companies must secure not only the AI agent, but also the containment mechanisms surrounding it.
Google Gemini Entered Three Real Companies
Google has now confirmed another striking incident involving Gemini.
During cybersecurity testing conducted in May, Gemini was supposed to attack fictional targets in controlled exercises. Because the testing environment inadvertently provided internet access, Gemini reached real-world systems.
Google said Gemini gained unauthorized access to systems belonging to three companies. In one case it guessed credentials; in two others it found credentials exposed publicly online and used them to access protected systems.
Google said Gemini stopped in all three instances. The affected companies were notified.
The incidents were confirmed Sept. 18 by Heather Adkins, Google’s vice president of security engineering.
Anthropic Finds Similar Problems
Anthropic has documented related incidents involving Claude.
After reviewing more than 141,000 cybersecurity evaluation runs, Anthropic initially identified three incidents in which Claude reached the internet and gained unauthorized access to production systems belonging to three organizations.
The models had been told they were operating inside simulations without internet access, but a testing misconfiguration actually provided internet connectivity.
In the most serious case, Claude accessed a database containing several hundred rows of production data.
Again, the models weren’t apparently pursuing some independent objective. They were attempting to complete cybersecurity assignments researchers had given them.
An AI agent therefore doesn’t have to “go rogue” to create a security incident.
“Absolutely,” Stiennon said when asked whether an agent simply pursuing a legitimate assignment could cause damage. “The agent is goal driven and a human cannot think of all the bad outcomes.”
AI Agents Become A New Identity Problem
Another concern arises as companies give AI agents permissions to operate inside their networks.
Security researcher Patrick Wardle recently demonstrated how malware already running on a computer potentially could hijack Meta’s Muse AI agent and leverage permissions granted to that agent.
Stiennon sees privileged AI agents as a significant new attack surface.
“No question,” he said.
Independent research indicates the identity-management challenge is already substantial.
Palo Alto Networks’ 2026 Identity Security Landscape, based on responses from more than 2,900 cybersecurity decision-makers worldwide, estimates that organizations now have 109 machine identities for every human identity — including 79 AI-agent identities per human identity.
That doesn’t mean an average employee personally operates 79 AI agents. Rather, it reflects the rapidly expanding population of automated identities that corporate security systems must discover, authenticate and control.
Stiennon argues today’s identity systems aren’t prepared for the scale AI agents could eventually create.
Healthcare May Face Immediate Michigan Risk
Stiennon said every industry deploying autonomous agents should be concerned but singled out healthcare as potentially facing one of the most immediate problems.
“Imagine a lab doing research on patient histories and an agent breaking out of the containment system that only gives it access to anonymized patient data,” he said. “Every exposed record is a HIPAA violation.”
Michigan’s exposure extends well beyond healthcare.
Automakers and suppliers possess proprietary vehicle software, autonomous-driving research and engineering information. Defense contractors handle military technologies. Advanced manufacturers increasingly connect software with physical equipment. Michigan universities conduct valuable commercial and government-funded research.
All are potential environments where autonomous AI agents could eventually receive substantial access to sensitive information and computer systems.
Treat AI Agents Like Employees
Stiennon said companies should approach AI-agent access much as they would human employees or service accounts.
“Assign privileges and authorizations carefully,” he said. “Strive towards least privilege. Only allow work on scrubbed data sets.”
In practice, that means companies should avoid automatically giving an AI agent all the access its human operator possesses merely because doing so makes the agent more useful.
Businesses also need to know which AI agents are operating inside their organizations, what credentials they possess, which data they can reach and whether their activities are being monitored.
And that may be the most immediate problem.
Asked whether businesses are deploying autonomous AI agents faster than cybersecurity departments can secure them, Stiennon offered perhaps the strongest warning of all:
“Most security teams are unaware that the company is deploying agents,” he said. “They are in for a surprise.”
