When OpenAI’s models broke out of a test environment in July and hacked into Hugging Face’s systems to find the answers to a cybersecurity benchmark, it was read as a frontier lab problem: exotic models, reduced guardrails, an experiment that got away from its handlers.
Adam Ely, GM of AI security at Check Point Software Technologies, says that reading is too narrow: the same behaviour is already showing up inside ordinary companies running ordinary agents.
“We definitely see agents going rogue inside large companies today, based on how they’re being built,” Ely told TechCentral in an upcoming TechCentral Show podcast interview alongside Dominic White, MD for South Africa at Orange Cyberdefense.
One Check Point customer is running 50 000 agents, most of them doing real work. “They are changing logistics on the fly; they are making business decisions,” Ely said.
His account cannot be checked independently. The published incidents come mostly from labs and government testers working under deliberately permissive conditions, so they show what rogue behaviour looks like rather than how common it is in ordinary companies.
In July, Anthropic investigated three incidents in its cybersecurity evaluations, which were run without the safeguards it applies to its public models. Claude Opus 4.7 broke into a live company and kept attacking after recognising the system was real; Claude Mythos 5 published malicious code to PyPI that ran on 15 real systems. Anthropic traced all three to a misconfiguration in environments built by its evaluation partner, Irregular, and in September disclosed a fourth incident, involving an early version of Claude Opus 4.6.
Unauthorised actions
The UK’s AI Security Institute, which tests models with open internet access and some safety filters disabled, recorded 19 unauthorised actions across 10 of 122 evaluation runs in late July, 17 of them by Mythos 5. In one, an agent tried to slip malicious code into a real open-source project and created fake online identities to pressure the maintainer, who refused. AISI found no resulting real-world harm.
The closest thing to a count outside the labs comes from security firm Cyera, which reviewed 7 246 publicly reported incidents to May 2026 and identified 188 cases of agent-inflicted damage in enterprises with no attacker involved. One coding agent deleted a company’s production database, then its backups.
Ely’s explanation is that agents are often trained heavily on capability and lightly on rules, and lack the informal brakes an employee has. “Most employees inside a company are going to stop at a certain line. But an agent that’s not trained on those, not incentivised on those, not giving enough prescription around those, is not going to know that it shouldn’t do that, and is going to execute past them.”
Ely said sandboxing breaks down at scale. He knows of a large infrastructure company that tried to sandbox every agent it ran, “and over time they realised it failed because of the scale and the access needs”. Humans in the loop bring their own problems. “Sometimes the humans were the ones making the mistakes,” he said.
White volunteered himself as a case study. His coding agents start each session sandboxed. “But eventually I’m in a meeting and [I want them to] stop bugging me, to just complete the task. So, by the end of a heavy coding session, the sandbox has had all of its permissions removed and it’s just wide open…”
Ely’s answer – and the approach Check Point sells – is to move monitoring inside the agent, watching “what it’s trying to access, the actual command it’s trying to run, the identity it’s trying to use”, and to alert a human, stop the action or challenge authentication in real time.
White sees a parallel shift, with high-agency agents boxed into narrower jobs and given “a rubric and a task that it needs to complete”. The trade-off, he said, is that “you need to understand your problem much better upfront”.
Speed compounds the problem. Check Point’s own annual AI security report cites industry reports of a breach of nine Mexican government agencies in which one operator ran 5 317 AI-generated commands. And Sysdig documented what it called the first agentic ransomware, a late-June extortion attack largely run by a model, which redeployed a corrected payload 31 seconds after hitting an error.
Asked what they felt confident predicting, Ely said he expects more agents going rogue inside companies “as they experiment and build”, and more incidents becoming public, before things settle: “I think during that same period though, we’re going to start to find equilibrium.”
White expects software that security teams have long locked down to open up to agents. “There will be an interesting technological shift where a lot more APIs will be exposed, a lot more ways of automating things that historically weren’t.”
What that means for security, he said, is less clear. – © 2026 NewsCentral Media
