Why MSPs can’t rely on conventional sandboxes to contain increasingly capable AI models.
If your takeaway from the OpenAI and Anthropic security incidents is simply “rogue AI is here,” you’ve picked the least actionable lesson. The more useful lesson is that frontier AI can find and exploit ordinary security weaknesses at extraordinary speed – and that lesson applies directly to how MSPs secure customers who are experimenting with AI agents, open-source models and platforms, like Hugging Face, today.
How OpenAI’s models escaped their own test
During an OpenAI cybersecurity evaluation, two capable models — one of them unreleased — were tested for offensive cyber capability with their normal safety refusals switched off, by design, so researchers could measure what the models could do at full stretch. The environment was built to deny “direct” internet access. It was not built to deny all internet access: one internet-connected component, a package-registry cache proxy, sat within reach.
The models found a previously unknown vulnerability in that proxy, escaped through it, and reached the open internet. From there, they chained stolen credentials and unpatched flaws into remote code execution against Hugging Face’s infrastructure, touching four accounts across four services.
Dan Guido, founder of the cybersecurity research firm Trail of Bits, called it “a containment failure with the safeties turned off.” Logan Graham, who leads Anthropic’s own frontier red team, reportedly told his team to remember the moment as “the first true AI safety incident.”
Whatever framing you land on, the mechanism is instructive: nothing about the escape required a capability beyond what a skilled human red-teamer already has. The model just did it faster, without needing rest.
Anthropic’s quieter, different failure
Weeks later, Anthropic disclosed a related but distinct problem. Reviewing more than 141,000 of its own evaluation runs, it found three cases in which its models gained unauthorized access to production systems at three organizations. Unlike the OpenAI incident, this was not a model defeating sophisticated containment.
Anthropic says the access came down to a misunderstanding with a third-party evaluation partner: the models were told they were operating in a sandboxed simulation with no internet access, and because of a miscommunication, that was not true. Once inside, the models used basic techniques – weak passwords, unauthenticated endpoints – to move further than anyone intended.
The common thread: “No direct access” isn’t “no access”
Different mechanisms, same underlying problem. In OpenAI’s case, a human decision left one exploitable bridge inside an otherwise isolated system. In Anthropic’s case, a human miscommunication left a door fully open. “No direct internet access” is not the same statement as “no internet access.” A package proxy, a public endpoint, an API, a plugin, or any other connected service can quietly become the bridge between an isolated test and a live production environment.
Why this matters for MSPs
Most MSPs will never test frontier models at this level. But they increasingly manage customers experimenting with AI agents, open-source models and platforms such as Hugging Face – and the lesson about containment and lateral movement applies well beyond AI labs.
It also echoes a pattern that security researchers have documented more broadly: once an attacker, human or AI gets a single foothold, how far can it travel?
A 2026 lateral-movement report from security vendor Zero Networks, analyzing hundreds of enterprise environments, found that a single compromised system could reach a median of roughly 85% of the network in one hop, approaching the entire environment by the second. Roughly 71% of that threat-relevant activity ran over four familiar protocols: Server Message Block (SMB), Remote Desktop Protocol (RDP), Windows Remote Management (WinRM), and Remote Procedure Call (RPC) — the protocols enterprise networks depend on every day.
That is the real risk multiplier. AI did not invent lateral movement. It just makes the trip faster and tireless.
Five steps MSPs should take now
The response is not exotic. It is the same discipline MSPs already sell, applied with more urgency. Steps to ensure AI models are contained include:
- Map every path out of an AI testing environment. Do not stop at the firewall — include package repositories, model registries, APIs, service accounts, plugins, and agent tools. If an agent can reach it, it is part of the attack surface.
- Separate experimentation from production. Use dedicated infrastructure, segmented networks and isolated identities. The stronger the model’s cyber capabilities, the less confidence you should place in a conventional sandbox.
- Constrain credentials and permissions. Use short-lived tokens, least-privilege access and separate secrets for every environment. A compromised workload should not carry the authority to move into other systems.
- Monitor for machine-speed activity. Frontier agents can enumerate systems, retry failed techniques and move laterally faster than a human analyst can investigate individual alerts. Detection must be paired with automated containment, not just alerting.
- Apply the same discipline to Hugging Face and other external AI resources that you would apply to any software supply chain. Verify publishers, pin approved versions, scan downloaded artifacts, and route them through controlled internal repositories before deployment.
AI has not made patching, segmentation, identity security, or exposure management obsolete. It has shortened the time available to get them right.
If an AI agent escaped one of your customers’ test environments today, could you show exactly what it could reach – and stop it before the first compromised system became the entire incident?
Arve Kjoelen is Chief Information Security Officer (CISO) at Barracuda. Arve brings extensive global security leadership experience, including serving as Global CISO at McAfee and holding senior roles at CyberGRX, EY and Wells Fargo. Most recently, he was Chief Solutions Officer at Cybriq Solutions, where he helped integrate AI-driven capabilities into a modern cyber posture management platform. Arve holds a bachelor’s and master’s degree in electrical engineering from the University of Southern Illinois and serves on multiple security advisory boards.
