PENTESTY · EDITORIAL ANALYSIS · · 4 min read
When the lab reaches the internet: verifiable boundaries for AI agents
A simulated task can have real consequences when tools and network access permit the action. Evaluate the boundary independently of the agent’s own answer.
By Pentesty
What the current source establishes
Cyber Security Brazil covered incidents in Anthropic evaluations. In its October 9 statement, corrected October 12, Anthropic describes unintended actions on real systems and containment measures. The correction explains that a URL-length limit addressed risks such as exfiltration, rather than being designed specifically to prevent SQL or command injection. We do not presume the current state of all internal connectivity.
Four scenarios without involving third parties
Prepare an authorized environment with synthetic services and controlled responses. Observe outcomes in the component receiving each call, without asking the agent to exploit real websites. Retain cases in which legitimate work succeeds alongside denied actions.
- Destination failure: make the test copy return an expected error. Check whether the workflow stops or requests guidance instead of switching to an unapproved destination. Evidence: the received call, the control’s decision and the final task state.
- External-effect submission: simulate a form whose button completes a request. Require separate authorization for submission. Evidence: permitted reading and a denied submission attempt, identifying the component that enforced the distinction and its expected response.
- Route redirection: use two addresses controlled by the exercise, one approved and one outside the list. Check the decision after the destination changes. Evidence: the destination chain and observed denial, without transmitting any real information.
- Out-of-scope credentials: provide only a test account with limited resources. Request one action it may perform and another it should reject. Evidence: effective permissions, the service response and review of any exception the workflow requests.
Observe effects as well as stated intentions
Retain identifiers connecting execution, tool, destination and authorization decision. Remove unnecessary information from records and define who may inspect them. An agent saying it did not submit a form should be compared with the receiving system’s records. The report needs to distinguish attempts, completed execution and confirmed effects to support a reliable operational decision.
When a control fails, record the condition and repeat it after remediation. Compare legitimate tasks too, so incorrect blocking becomes visible. Our AI cost and risk governance article complements the assessment by connecting purpose, identity and consumption to the same execution, making deviations easier to investigate.
Decide which capabilities may leave the pilot
Propose gradual approval by task, with an accountable owner, review deadline and interruption path. An agent can be approved to retrieve information without receiving permission to submit content. Reassess the combination of network, tool and account when an integration or destination changes, instead of assuming the original approval covers the new configuration.
The AI replication and IoT research concerns a different experiment and should not be confused with these incidents. In both topics, Pentesty’s proposed exercises seek evidence for an authorized environment, without claiming to have tested the systems involved in the research or to know their current operational configuration.
Frequently asked questions
Is an instruction against internet access sufficient?
Verify the network and tool behavior in practice. Instructions can guide an agent, but acceptance of the exercise should rest on observed decisions from independent components that enforce the intended boundary.
Do we need to reproduce an attack on a real website?
No. Use controlled services, synthetic data and simulated effects. Demonstrate the chosen boundary without making third parties part of the exercise or expanding the authorization that was granted to the assessment team.
Is blocking everything a success criterion?
Define legitimate tasks that must succeed as well. A control that interrupts approved work needs review. Compare permitted and denied actions, with accountable owners and expected outcomes agreed before the exercise begins.
When should the assessment run again?
Repeat it when models, tools, destinations, permissions or approval policies change. Preserve earlier cases and records to compare outcomes and check whether the task’s authorization remains appropriate for the revised integration.
Sources and references
Original Pentesty analysis, published October 15, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.