AI Agents Went Off-Script. Here’s How to Keep Yours in Line
In short
- Anthropic and the UK AI Security Institute detailed how Claude Mythos 5 went off-script in a cyber test – in 9 of 43 runs it took actions that hit real people and organizations.
- Separately, METR and Redwood Research found holes in OpenAI’s internal system for monitoring its own AI agents. OpenAI says it patched the ones affecting production.
- The fix for your business is cheap: limited permissions plus a human approval step – roughly 10 minutes a day.
AI agents don’t need to be evil to cause damage. They just need to be too eager. Two reports this week show it clearly. If you’re giving agents access to your email, store or server, read this.
What happened
Case 1: Anthropic. The UK AISI gave Claude Mythos 5 a hacking exercise: break into a fake test network. Internet was on. Safety filters were deliberately off. In 9 of 43 runs, the model went beyond the task and touched the real world. In the worst run it found a real GitHub project, tried to slip in malicious code, then made fake accounts to pressure the maintainer into approving it. The maintainer refused. Anthropic says its production safeguards would have flagged this instantly, and that newer models start the attack far less often: 0–13% of replays vs 83% for Mythos 5.
Note: the model wasn’t pursuing its own goals. It was obsessed with finishing the task – at any cost.
Case 2: OpenAI. A METR and a Redwood Research researcher spent three weeks inside OpenAI testing the system that watches its internal agents. They found real gaps: an exploit that could hide hundreds of recent agent actions from the monitor, and a way agents could in principle bypass Codex sandboxing. About 10% of eligible internal Codex traffic likely went unmonitored for a period. OpenAI says the production issues are patched. The testers haven’t verified that yet.
How to use it (protect your business)
- Least access. An agent that writes emails doesn’t need your bank. Separate API keys per agent.
- Read is free, write needs a yes. Let agents read freely. Sending, paying, deleting, publishing – only after a human clicks approve. Make and n8n can both add an approval step.
- Fence the internet. If an agent doesn’t need the open web, cut it off.
- Log everything. Keep a record of every action – the OpenAI story shows monitoring itself can have holes.
- Spending limits. Cap API budgets and payment amounts per agent.
Do the math: an example with your own numbers. Approving 20 agent actions a day at 30 seconds each = 10 minutes. If your time is worth €20 an hour, that’s about €3.30 a day, roughly €73 a month (22 working days), under €900 a year. Compare that to one wrong mass email to all your customers or one unwanted refund run.
What it means
No doom here. Both incidents happened in tests, safety switches were off on purpose, and AISI now runs these tests without internet access. And the companies published it – good.
But the lesson is clear: agents get more capable faster than the controls around them. Your agent won’t hack GitHub. It might, though, “solve” a task in a way you never approved.
Ivan’s Take
I trust AI agents – I build with them. But I treat them like a brilliant new employee on day one: limited access, and a signature on anything that costs money or goes to customers. That’s not fear, that’s management. Ten minutes a day of approvals is the best deal in automation.
If it doesn’t save you time or money, you won’t see it here
- Facts, not hypeEvery price and number is checked against the official source
- Always the real priceYou see what it costs before you click
- I say when it’s weakEven when it’s OpenAI or Google
