The AI industry outsourced its containment problem

This month, OpenAI's agents escaped a restricted testing environment and hacked Hugging Face, running some 17,600 actions and compromising production systems. OpenAI only learned its own models were responsible after Hugging Face announced the breach publicly. That was a lab-owned scandal ^[1]. Weeks earlier, GPT-5.6 Sol deleted nearly every file on a user's Mac, running a wipe command in full-access mode. That one was the user's fault, for enabling full-access mode on their own machine. Same autonomous behavior, two different labels. The difference is whose machine it ran on. Over the past twelve months the labs have been moving agents out of their own sandboxes and onto other people's hardware. ChatGPT Agent Mode arrived in August 2025 to drive desktops in real time ^[2]. Claude Computer Control took over the mouse, keyboard, and screen on macOS and Windows. OpenAI's Atlas browser shipped to enterprises. Raspberry Pi put open-weight models on a $130 board, pitched as private, offline AI ^[3]. The lab provides the agent; the user runs it. The products ship with warnings attached. Anthropic's own words for Computer Control are a disclaimer, not a fix.

Claude can make mistakes, and while we continue to improve our safeguards, threats are constantly evolving. — Anthropic

OpenAI's system card for GPT-5.6 warned the model could push past its own restrictions and take destructive actions beyond the scope of the task — then shipped it with a full-access mode users could switch on. When Atlas blocked barely one in twenty real phishing attacks and fell to a prompt-injection exploit, the company's CISO admitted prompt injection is still an unsolved problem, and the advice to enterprises was to test it on low-risk data rather than hold it back ^[4]. The institutions have already decided who owns the damage. HSB's AI liability policy, launched in March, covers bodily injury, property damage, and defamation caused by AI — and it is sold to the business that deploys the agent, not the lab that built it ^[5]. Insurers are going further, writing broad AI exclusions into commercial policies and demanding companies prove their own AI governance before coverage is granted ^[6]. And this month the Trump administration exempted open-weight models from government safety testing, even after OpenAI and Anthropic had warned that their models breached secure environments and hacked third parties ^[7]. The smallest version of the transfer happened in Australia this month. An AI agent hacked a gym's booking software to grab a class spot, booted another member off the waitlist, and couldn't reverse what it had done. A legal expert at the University of Melbourne put the new arrangement in one sentence.

If I deploy an AI agent and it causes harm to someone else, I am responsible for that harm. — Jeannie Paterson