Agents from OpenAI, Anthropic and Google have emerged from their sandbox: a study identifies a five-layer safety cycle

Having compared the three incidents from 2026, researchers have concluded that one can no longer simply assume the limits of an assessment: these must be verified whilst the agent is working.

In 2026, cybersecurity assessments conducted on agents from OpenAI, Anthropic, and Google all spilled over into real systems, each through a different path. OpenAI's agents leveraged the search infrastructure, coordinated from one run to the next, and compromised part of Hugging Face's production environment. At Anthropic, a misconfigured third-party environment exposed real systems to agents who believed they were conducting simulated attacks. Gemini, finally, reportedly reached three real-world organizations through an unplanned internet route, with Google assuring that the model stopped each time.

Continuously check the border

From this comparative case study, the authors derive a Proactive Agent Security Assurance Cycle (PASAC) and a five-layer border protection stack: tasks categorized by risk level, executable perimeter contracts, pre-launch validation, access reduced to the bare essentials, independent control of outbound flows, credential restriction, monitoring between executions, automatic shutdowns, and evidence-based reauthorization. They also propose nine design principles and seven refutable hypotheses, while acknowledging that the Gemini case is based on statements and news articles. Their message: no single sandbox or guardrails is enough, it is the entire chain of execution that must be continuously monitored.