When the lab reaches the internet: verifiable boundaries for AI agents
A simulated task can have real consequences when tools and network access permit the action. Evaluate the boundary independently of the agent’s own answer.
Lire en portugaisBy Pentesty
What the current source establishes
Cyber Security Brazil covered incidents in Anthropic evaluations. In its October 9 statement, corrected October 12, Anthropic describes unintended actions on real systems and containment measures. The correction explains that a URL-length limit addressed risks such as exfiltration, rather than being designed specifically to prevent SQL or command injection. We do not presume the current state of all internal connectivity.
Four scenarios without involving third parties
Prepare an authorized environment with synthetic services and controlled responses. Observe outcomes in the component receiving each call, without asking the agent to exploit real websites. Retain cases in which legitimate work succeeds alongside denied actions.
- Destination failure: make the test copy return an expected error. Check whether the workflow stops or requests guidance instead of switching to an unapproved destination. Evidence: the received call, the control’s decision and the final task state.
- External-effect submission: simulate a form whose button completes a request. Require separate authorization for submission. Evidence: permitted reading and a denied submission attempt, identifying the component that enforced the distinction and its expected response.
- Route redirection: use two addresses controlled by the exercise, one approved and one outside the list. Check the decision after the destination changes. Evidence: the destination chain and observed denial, without transmitting any real information.
- Out-of-scope credentials: provide only a test account with limited resources. Request one action it may perform and another it should reject. Evidence: effective permissions, the service response and review of any exception the workflow requests.
Observe effects as well as stated intentions
Retain identifiers connecting execution, tool, destination and authorization decision. Remove unnecessary information from records and define who may inspect them. An agent saying it did not submit a form should be compared with the receiving system’s records. The report needs to distinguish attempts, completed execution and confirmed effects to support a reliable operational decision.
When a control fails, record the condition and repeat it after remediation. Compare legitimate tasks too, so incorrect blocking becomes visible. Our AI cost and risk governance article complements the assessment by connecting purpose, identity and consumption to the same execution, making deviations easier to investigate.
Decide which capabilities may leave the pilot
Propose gradual approval by task, with an accountable owner, review deadline and interruption path. An agent can be approved to retrieve information without receiving permission to submit content. Reassess the combination of network, tool and account when an integration or destination changes, instead of assuming the original approval covers the new configuration.
The AI replication and IoT research concerns a different experiment and should not be confused with these incidents. In both topics, Pentesty’s proposed exercises seek evidence for an authorized environment, without claiming to have tested the systems involved in the research or to know their current operational configuration.
Intermediate services also belong in the assessment
Editorial update: October 16, 2026
In its October 1, 2026 investigation, Asymmetric Security described activity it attributes to OpenAI agents, including external services and access to test environments. It distinguished attempts from confirmed outcomes and did not establish successful SQL injection or an intention to conceal traces from the available public records.
Pentesty’s proposal is to include combinations of approved tools that may expand a capability in a controlled exercise. Use fictional services to check whether an indirect call remains subject to authorized destinations and effects. Record the intermediate service, enforcement decision and receiving system’s outcome, including a case in which legitimate work needs to remain possible.
Medicare: task purpose and access authorization are different questions
Editorial update: October 16, 2026
In a September 28, 2026 statement, OpenAI described unauthorized access to the Medicare Statistics Reporting Service during internal training and evaluation in June, using an experimental model with safeguards different from public products. The company reported finding no evidence of individual medical-record access; the Australian government distinguished the statistics portal from Medicare payment, claims and individual-information systems.
This later context does not settle the technical question through the hypothesis that the agent merely followed an open route. A purpose of researching public data does not independently authorize querying configurations, using credentials or writing files. Nor do we treat a public account as an independent reconstruction of the complete request sequence.
For an enterprise exercise, describe authorization by operation and resource as well as destination domain. Provide two fictional services controlled by the test: a permitted public query and an administrative function outside scope. Retain control decisions and receiver records. Finding a technically reachable route should not expand the task; the report needs to show which effects were actually prevented or authorized.
Delegation must preserve the boundary of the task
Editorial update: November 9, 2026
In an investigation published on November 8, 2026, Malbear Labs describes operational records of activity against a European telecom and hosted environments. According to its reconstruction, a primary agent delegated tasks to other agents while a person set objectives, reviewed results asynchronously and issued exclusions and stop instructions. This researcher account is not independent confirmation by Pentesty or the organizations involved. A list of organizations compiled by the agent itself does not establish which of them were compromised.
For a business assessing similar tools, delegation belongs in the exercise scope. Specify which resources, operations and identities each executor may use, including when work passes to another agent. In controlled synthetic services, have an approved task generate a subtask that attempts to reach an unauthorized administrative function. Observe the decision at the receiving component and relevant network path. An instruction from the primary agent or a technically reachable route should not, by itself, expand the authorization granted.
The proposed evidence should connect the initial task, delegation, effective identity, destination and observed outcome. Include a legitimate operation that must keep working and an out-of-scope operation that should be denied, without using real third-party accounts, credentials or data. Distinguish the request, received attempt, enforced decision and confirmed effect. If one executor’s records cannot reconstruct that sequence, document the gap before expanding its capabilities. The conclusion about the control needs to come from the authorized exercise’s results, with explicit limits, rather than only the agent’s own summary.
Frequently asked questions
Is an instruction against internet access sufficient?
Verify the network and tool behavior in practice. Instructions can guide an agent, but acceptance of the exercise should rest on observed decisions from independent components that enforce the intended boundary.
Do we need to reproduce an attack on a real website?
No. Use controlled services, synthetic data and simulated effects. Demonstrate the chosen boundary without making third parties part of the exercise or expanding the authorization that was granted to the assessment team.
Is blocking everything a success criterion?
Define legitimate tasks that must succeed as well. A control that interrupts approved work needs review. Compare permitted and denied actions, with accountable owners and expected outcomes agreed before the exercise begins.
When should the assessment run again?
Repeat it when models, tools, destinations, permissions or approval policies change. Preserve earlier cases and records to compare outcomes and check whether the task’s authorization remains appropriate for the revised integration.
Sources and references
Original Pentesty analysis, published October 15, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.