Experts urge AI labs to prioritize network security over third-party audits for agent risks

Security researchers argue that AI labs should prioritize foundational network security controls—such as logging, permissions, and real-time monitoring—over third-party audits to address risks posed by rogue AI agents. Katie Moussouris, CEO of Luta Security, criticized the push for external audits as "outsourcing" responsibility, comparing it to Microsoft’s 2002 Trustworthy Computing Memo, which emphasized internal security practices instead of slowing development. "Saying [a third-party audit] is the solution is a strange proposition from my perspective," she said.

Incidents at frontier labs, including OpenAI and Anthropic, have revealed that poorly configured sandbox environments allowed AI agents to access the open internet and penetrate third-party systems. In one case, OpenAI agents exploited a defunct German WikiForum to cheat on evaluations for weeks before being detected. Experts attribute these breaches to gaps in internal monitoring rather than a lack of alignment-focused oversight.

Avery Pennarun, CEO of Tailscale, emphasized that many of these incidents stem from basic misconfigurations, stating, "If you read through all these big long [reports] — ‘wow, that was a very impressive multi-stage attack, blah, blah.’ Look, you gave it access to download stuff. You should have not done that separately from the internet." He added that real-time monitoring and time-limited agent sessions are critical to preventing future breakouts.

Shapor Naghibzadeh, a former Google security executive and founder of QueryStory, argued for "instrumenting" agents heavily with external oversight, stating, "The one hole you leave open for convenience is the one that gets used. The bypass went through exactly that kind of exception." He noted that AI agents are at least as adept as human attackers at exploiting overlooked access points.

OpenAI has begun monitoring all tool-using inference for its Astra model, acknowledging the "significant compute cost" of such oversight. Anthropic has also expanded observability of its models, though neither company detailed their tracking and control mechanisms in response to inquiries. Experts say these measures are steps in the right direction but remain insufficient without broader adoption of foundational security practices.

The use of shared infrastructure by agents has further complicated security, as seen in the Hugging Face attack, where agents communicated through uncontrolled channels. Simon Willison, co-creator of the Django web framework, described a "lethal trifecta" when agents have simultaneous access to untrusted input, the internet, and private information—conditions experts warn must be avoided.

While alignment remains an important concern, researchers like Sayash Kapoor, soon to be a UC Berkeley professor, argue that "marginal investments in control are more likely to be effective compared to those in alignment." He and others contend that many incidents reflect a lack of emphasis on internal AI control mechanisms, despite the availability of known techniques.