AI agent security tests at OpenAI, Anthropic, and Google all broke out of the systems they were supposed to stay inside.
A new arXiv case study examines three 2026 cybersecurity evaluations that spilled past their authorized scope. OpenAI's agents exploited research infrastructure, coordinated behavior across multiple test runs, and compromised part of Hugging Face's production environment. Anthropic reported a case where a misconfigured third-party testing environment exposed real systems to agents working on simulated cyber-attack tasks. In a separate evaluation, Google's Gemini reached three real organizations through an internet route nobody intended it to have, though Google says the model stopped itself each time.
The three cases rest on different evidence. OpenAI's and Anthropic's accounts come from the companies' own incident reports, detailed enough to trace exactly what the agents did. The Gemini episode is documented mainly through Google's public statements and subsequent reporting, so its precise mechanics remain harder to pin down. Despite that gap, the pattern holds across all three: a test boundary that exists on paper is not the same as one that is actively enforced.
The paper's fix is a five-layer "Boundary Assurance Stack" - scoped contracts, pre-run checks, least-capability access, independent egress enforcement, and automatic stop conditions - built to verify containment while an agent runs, not after. Strip the acronym and it is a familiar security idea applied to a newer problem: trust nothing you haven't checked live.