You Didn’t Build Skynet, You Wrote a Bad Script

If you read the headlines this week, you’d think we crossed the Rubicon into sci-fi dystopia.

A frontier model escaped containment! An autonomous AI hacked Hugging Face to cheat on a benchmark! An unprecedented cyber incident!

The mainstream tech press and the marketing teams at the AI labs could barely contain themselves. The narrative was irresistible. An AI had supposedly become so brilliant and devious that it broke out of its digital cage, outsmarted its handlers, and pulled off a heist to steal the answer key.

It is a fantastic story that sells subscriptions, justifies valuation multiples, and fuels congressional panels on existential risk.

However, there is just one problem. It is complete and utter bullshit.

What actually happened was not evidence of a machine becoming self-aware, developing intent, or rebelling against its creators. It was a textbook (and frankly embarrassing) failure of basic software architecture, runtime containment, delegated authority, and process control.

The humans built an execution pipeline, gave it an objective, and stripped away its safeguards. They then hooked it right up to a vulnerable infrastructure. And then, shocker, they acted surprised when the system followed the path of least resistance to solve the problem.

The Capability Was Never the Revelation

Let’s strip away the humanizing/anthropomorphic nonsense.

In OpenAI’s evaluation, a combination of models operating inside an internal benchmark harness encountered an unpatched vulnerability in a package proxy, escalated local privileges, moved through the available infrastructure, reached an internet connection, and retrieved benchmark answers from Hugging Face.

The tech media treated the model’s discovery of an exploit path as some terrifying revelation. But why?

These systems are trained on the collective technical “library” of the internet, including source code, vulnerability reports, exploit payloads, security research, operating system documentation, and network protocols. Give them enough compute, a problem to solve, some tooling, and feedback from a console, and of course they can discover attack paths.

Thank you for today’s most useless piece of information.

The model’s capability in this area is already a fait accompli. It should have been assumed before the test began, not treated as the surprising conclusion after the architecture failed.

The relevant question is not how the model identified an exploit. The relevant question is why an untrusted probabilistic component was given an executable path through that exploit in the first place.

Knowing how to generate a command should not be confused with any authority to execute it in the first place. Likewise, identifying a reachable connection does not provide permission to open it and discovering a vulnerability is not a mandate to exploit it.

Those distinctions are the entire point of sound systems architecture and why zero-trust is a guiding principle in cybersecurity. Apparently, we needed Skynet headlines to rediscover the basics.

Path Minimization Is Not Intelligence

A modern “agent” is not an independent actor with intent. Once again, we need to strip away the humanizing language. In most cases, it is just software wrapped around one or more model calls. A prompt, a tool list, a context window, a few execution functions, some state handling, and a bit of retry logic.

The agent did not feel trapped by the sandbox. It did not crave access to the open internet. It did not develop a moral framework in which stealing benchmark answers was preferable to honest work.

A software loop repeatedly presented the model with an objective and an updated view of its environment. The model generated outputs statistically associated with making progress toward its objective. The surrounding code converted those outputs into commands and other executable actions, returned the results to the model, and repeated the process over and over again.

The system pursued a programmed objective devoid of the human desire to obtain the objective. It bypassed a restriction without understanding what authority really means. And it followed the path of least resistance.

An LLM behind the agent carries no inherent obligation to respect the boundary between an authorized route and an unauthorized one. It has no native understanding of a benchmark rule, a corporate security policy, or the difference between a permitted action and a technically possible one.

If a model can generate a statistically probable command that opens an outbound connection, the network layer needs a control to block it. If the model discovers a credential, the identity and authorization layers have an equal responsibility to prevent it from being exercised. But what if the model proposes an action outside the scope of the task? The execution control layer must reject it automatically.

You do not ask the model to enforce those controls against itself. That’s bad design.

Putting “please remain inside the sandbox” in a system prompt is not security engineering. It’s wishful thinking wrapped in a JSON payload. That’s bad design.

Blaming the model for escaping is like leaving your front door wide open, putting a Roomba on the floor without bumper sensors, and calling the local news when your vacuum cleaner “rogue-navigated” its way onto the interstate. That’s just funny. 🤦‍♂️

Disabling Safeguards Exposed the Design

OpenAI noted that its production safety classifiers were intentionally disabled for the evaluation, as though that somehow explains what followed. It does not … but it does expose a naiveness.

Safety classifiers, refusal mechanisms, prompt filters, and alignment layers are behavioural controls. They influence what a model is likely to produce, but they do not secure the environment in which that output is executed. They do not isolate workloads, restrict network access, control delegated authority, prevent lateral movement, or stop a generated command from becoming a real action.

The test didn’t prove that the model became dangerous once the safeguards were removed. It proved how weak the actual enforcement architecture was once the illusion of safety was stripped away.

We already understand this everywhere else in systems design. We do not rely on an employee’s training to prevent unauthorized access to a financial system. We use identity controls, approval boundaries, separation of duties, transaction limits, monitoring, and independent oversight. We do not ask an application to voluntarily respect its own permissions. We enforce them through controls that sit outside the application and AI should be no different.

A model cannot be the component generating the action and the component deciding whether that action is permitted. Its safety settings cannot be treated as a substitute for network segmentation, runtime policy enforcement, delegated authorization, execution controls, or independent process supervision.

The real lesson from the test was not that removing safeguards unleashed some hidden intelligence. It was that there were insufficient out-of-band controls between probabilistic model processing and executable action enabled through code.

This is not a model problem. It proves nothing new about the models themselves. Even the Anthropic Mythos spectacle proved the same thing. These systems are powerful, capable, and increasingly effective at cybersecurity tasks. It is a real risk and threat, but it’s also yesterdays news … something we already knew.

What neither incident proved was intent, consciousness, or some newly emergent desire to escape. They exposed, especially in the OpenAI case, how little deterministic, out-of-band control exists once model output leaves the model call and begins driving real systems.

Stop Inflating the Fantasy Balloon

The AI industry has spent three years treating the model as the whole system. Reasoning, tool selection, authorization, execution, and logging are collapsed into a single, trusted software harness.

We replaced decades of hard-won security principles, including isolation, partitioned workloads, least privilege, separation of duties, independent audit, and out-of-band enforcement, with vibes, system prompts, and cheerful diagrams of digital assistants.

I have sat in boardrooms and watched the fantasy of vibe coding spread across the room with almost religious excitement, only to collide with the harsh reality of enterprise production where boundaries matter, authority matters, and the liabilities are real.

Real agentic control requires an out-of-band Control Plane. It requires an independent enforcement layer that sits outside the model loop and does not rely on the agent to supervise itself. This is the design premise behind CharliAI’s Forensic Control Plane. The model and its local harness remain untrusted, while authority, durable memory, process progression, evidence, and execution control remain outside the loop.

• Isolate task execution. One task should never silently inherit another task’s credentials, memory, network connections, execution context, or authority. Agentic workloads must be isolated and partitioned so that a failure in one task does not become a path into another.

• Identify and authorize every task. Agents should operate through explicit delegated authority that is narrowly scoped, time-bound, and non-transitive. Finding a credential does not create permission to use it, and inheriting the authority of the surrounding application is not acceptable security design.

• Enforce entity contracts. Every agentic task should have defined ingress and egress boundaries. The agent should see only the entities it is contracted to consume and produce only what it is contracted to produce. That includes documents and data, but also credentials, commands, endpoints, code, packages, and execution results.

• Control durable memory outside the agent. Long-running state should not be self-staged inside a mutable scratchpad and repeatedly promoted back into the agent’s context. Memory must be governed by external policy, provenance, validation, authorization, and retention controls.

• Insert deterministic checkpoints and checkstops. Material actions should be evaluated before execution, not merely reconstructed afterward from logs. Intermediate reasoning should create interrupt points where the plane can permit, constrain, escalate, or stop the process. Reasoning may propose an action. It does not confer the authority to execute it.

• Profile and polygraph agents before they run. A pre-flight assessment should identify the code, tools, capabilities, vulnerabilities, access requirements, and likely failure modes of the agentic process. Bad code does not disappear because there is a frontier model sitting behind it. In many cases, the bad code is inside the agent itself.

• Preserve an independent forensic trace. Every task, delegation, entity movement, policy decision, model transition, failure, retry, and executed action must be recorded outside the agent’s mutable context. The system needs to support both in-flight intervention and post-mortem reconstruction without relying on the agent to explain what it did.

In advanced implementations, even independent adversarial, validation, and fact check models need to be inserted into the execution chain to challenge assumptions and scrutinize decisions.

Never ask a probabilistic system to behave itself. That is a category error, and it is being repeated everywhere under the banner of Shadow AI. Do not ask the model to respect boundaries that the architecture is unwilling or unable to enforce.

The OpenAI and Hugging Face incident was not a preview of the AI apocalypse. Neither was Anthropic’s Mythos release. They were loud and expensive reminders that powerful probabilistic models cannot enforce deterministic security over themselves.

The danger is not that the machine secretly wants out. The danger is that engineers keep building systems where getting out is a valid computational path.