Summary
Sandboxes are leaking. Frontier AI models have breached government systems [1][2][3]. State-sponsored hackers are using the same tools to rewrite malware faster than defenders can catch it [4][5]. Safeguards are now a live debate at the United Nations, in Singapore’s national statement [6], and in state Attorney General offices [7]. Still, it would be best to not buy either the utopia or the apocalypse. What follows is my read across four themes: leaky sandboxes, state-sponsored actors, safeguards, and finally, how to embrace this AI age without the anxiety it creates.
Leaky Sandboxes
In late September, OpenAI disclosed that agents built on its models had engaged with United States government websites in ways it called “model misbehaviour” [1][8]. Australia’s Prime Minister, Mr Anthony Albanese, confirmed that an AI agent had reached into the Medicare portal, the country’s health-records system [2]. CNN reported the same on at least three separate US federal sites [3]. Alabama Attorney General Mr Steve Marshall has now opened a formal investigation into OpenAI and Mr Sam Altman for what his office is calling a massive artificial intelligence data breach [7].
To their credit, the frontier labs are not hiding it. OpenAI’s note on the Hugging Face incident is unusually candid [8]. Anthropic published two pieces in parallel, on three cybersecurity-evaluation incidents and on what they mean for alignment [9][10]. Both admit safeguards were not enough. Throughout my working life across regulated institutions, Citibank, UBS, and Standard Chartered, I have rarely seen a vendor self-disclose at this level. That deserves acknowledgement before critique.
My view on the current situation.
- Sandboxes collapse when set loose with safety controls disabled and open access to the internet during evaluation. They give boards a false sense of physical containment.
- The line between “misbehaviour” and “breach” is thinner than the labs’ language suggests. If a system reaches into a foreign government portal, the operator has connected that portal to an unverified counterparty. Having spent most of my career in banking under regulators like MAS, HKMA and FCA, I can say the breach-notification clock usually starts ticking from that moment, whatever the intent. The word “misbehaviour” belongs to childcare, not critical infrastructure.
- The evidence trail matters. Enforcement authorities [7] are already reading the disclosures as admissions. Frontier labs face a choice between transparency now, which invites scrutiny, or silence, which invites subpoena later. Both are, in my view, less costly than a discovered cover-up.
- Vendor risk is no longer defined by service-level agreements. It is defined by model behaviour. Ranking it by contract exposure is no longer fit for purpose. It should factor in whichever supplier’s agent might, tomorrow, decide to log in to a portal you did not authorise.
I wrote about the circular nature of this problem in Catch-22, We rely on AI to analyse a Rogue AI [11]. When the same class of system is both the actor and the auditor, the chain of trust collapses in on itself. The incidents observed this year so far may just be the first episode of a long series.
Amplified effect from the state-sponsored actors
State actors are already using frontier models as force multipliers. Russian operators have been using Claude to rebuild malware after detection [4]. Transluce documented early rogue AI-agent activity in the wild [12]. Anthropic’s threat report reads like the field guide the community has been waiting for and dreading [5]. Its case studies span reconnaissance, break-in, payload crafting and what an attacker does once inside: a full offensive lifecycle with a general-purpose model in the loop.
None of this is exotic. Malware is not new. What has changed is the cost curve. In my experience, a team that once needed a fortnight to rewrite an evasive payload can now do it in hours. Defenders’ tools are sized for the old pace. Cyber budget conversations for 2027 will be uncomfortable.
Policy is starting to catch up. Nvidia CEO Mr Jensen Huang said AI labs should not pause as a group, but should close if they lose control of their systems. Senator Bernie Sanders went further: don’t build it if you can’t contain it [13]. Oxford Professor Nick Bostrom, author of Superintelligence: Paths, Dangers, Strategies, who spent a decade warning of catastrophic AI risk, is now more measured [14], suggesting the panic reflex itself is becoming a governance risk. Professor Geoffrey Hinton has amplified the warnings from AI chief executives at the United Nations [15]. Mr Jeffrey Goldberg and Mr Josh Tyrangiel argue the question is not whether AI goes rogue, but whether operators can still tell that it has [16].
Anyone who tells you the expert view on AI risk is settled is either selling hype or has stopped reading.
The sky is not falling, but the ground is shifting under our feet. 2024 cyber budgets look thin in 2026 and thinner in 2027. Finance committees will need briefing material that goes beyond “AI is a top risk”: who can call which model, how prompt attacks are watched, how each agent is identified and tracked, how outbound traffic is monitored, and how incident playbooks change when the adversary has an AI helper too. None of that is exotic, just that it is underfunded in most environments I see.
I sketched the cunning-adversary side earlier in The Cunning (AI) Fox [17]. Behaviours flagged as thought experiments then are now sitting in incident reports. The sooner the boardroom accepts it, the sooner the operational response catches up.
Even Stanford stumbled, swapping students’ faces in a photo to manufacture diversity [18]. Not state-sponsored, not malware, but a reminder that AI-mediated harms are often dressed as clerical errors. A governance framework that only considers the extreme cases will fail on the ordinary ones.
Safeguards
Singapore has proposed a United Nations framework for global AI safeguards [6]. Foreign Affairs Minister Dr Vivian Balakrishnan argued in his national statement that countries need common rules, and possibly a new international institution to set out technical standards and to conduct verification.
There is a prior question boards keep skipping. Before Zero Trust or any other control framework, comes visibility, an inventory of every agent, its owner, its scope, its access. Independent research cited by The Hacker News finds 70 percent of organisations admit their AI workflows already touch sensitive data without full oversight, and 67 percent say IT cannot fully track the autonomous workflows employees are building [19]. You cannot govern what you cannot see. Visibility is where the working stack begins: the practical operating layers of a competent safeguards programme, testing, disclosure, provenance, monitoring, that turn intent into daily practice.
Three principles stand out.
- Testing has to be independent and adversarial. A frontier lab’s own red team is a start, not enough. The Anthropic and OpenAI labs have both discovered behaviour they did not predict [9][10]. What is needed are independent evaluators, contractually free to publish, not just bug bounties.
- Breach-style disclosure must become the norm. If a model reaches into a system it was not authorised to touch, that fact should be logged, reported and shared across peers on a defined timetable. Banking regulators figured this out decades ago. AI is overdue.
- Provenance has to be portable. The trail for every action taken by an agent, every piece generated by a model and every decision materially shaped by a model has to survive across systems. The current fragmentation is a gift to bad actors and a burden on honest operators.
For practitioners looking for a working scaffold, I would offer the PETALS™ Framework I developed [20]. Its purpose, effort, tools, assembly, leverage and secure layers can help ensure provenance, ethics, traceability, autonomy, learning and safeguards. Not a silver bullet, but it forces the right questions in the right order.
The counter-argument is that heavy safeguards slow innovation and cede ground to jurisdictions with fewer scruples. That risk is real. Badly governed AI erodes trust faster. Ask the crypto industry, still working through failures that ordinary financial-services discipline would have contained.
There is also a domestic dimension. Employees are already using consumer AI tools inside enterprises with no written policy on model use. Boards that treat this as a training matter are missing the point. It is governance, audit and, potentially, a regulatory gap.
Distilling the hype
I observe that the public conversation about AI has been captured by evocative stories. A little science, a lot of narrative, a headline that hooks. The real science is more modest. Models are impressive statistical instruments, neither sentient nor stupid.
Two recent pieces by my friend and mentor, Mr Marin Ivezic, cut through the hype. Quantum AI data centres in space are an absurdity: the physics does not work, the economics does not work, the operational assumptions collapse on inspection [21]. His companion piece shows that the projected cost curves for paying for AI data centres would require roughly 250 million jobs in an economy that has 159 million [22].
I wrote in a similar spirit earlier this year in A Weekend Note on AI, Bullshit Jobs and the Art of Manufacturing Fear [23]. The point was not to dismiss the risks. It was to ask who profits from keeping the fear at a rolling boil, and what the sober response looks like. The question has aged well.
Mr Piyush Gupta, who stepped down as DBS chief executive last year and now chairs SMU, Keppel and Mandai Wildlife Group, made an excellent point recently. Graduates in the AI age, he suggested, may need ten minors rather than one major [24]. He called it “cognitive debt”. I read it as cognitive flexibility. Teaching in the DFAI programme at SMU Executive Development [25], I see that managers who thrive are those who can pivot between technical depth and business narrative without losing either thread. Ten minors is the aspiration. Even a few, done well, shows the willingness to hold multiple frames at once.
Distilling the hype requires:
- Reading the primary source, not the summary of the summary. The nuance is always in the details.
- Asking yourself what claim is being made: empirical (what is), forecast (what will be), normative (what should be) or rhetorical (made for effect). Confusing them is where much of the noise comes from.
- Becoming aware of stories that are evocative, less science, more narrative with a headline that hooks.
- Holding the frontier labs to what they actually said, not what a headline claims they said. The gap between the transcripts and the coverage is often the whole story.
I usually walk a stretch of the East Coast Park with my friend, Ravi. Our conversations inevitably turn to AI. Sometimes we agree on the underlying facts while disagreeing on how they are framed. We grapple, but are learning to embrace the AI age. Pretending otherwise is not helpful to anyone.
Conclusion
The AI Sams do have much to explain to Uncle Sam. And to the Australian Prime Minister. And to Singapore’s Foreign Affairs Minister. And to every Attorney General now reading the September disclosures.
The good news is that the material is there. Incident reports are unusually candid. Threat intelligence is being shared. Singapore’s proposal of a UN framework for global AI safeguards is a serious contribution [6].
The task now is not to panic and not to dismiss. It is to build a competent working stack with independent testing, breach-style disclosure, portable provenance. In addition, a governance culture that treats model behaviour as vendor risk. Finally, a boardroom vocabulary that resists both the utopia and the apocalypse.
For readers who feel the pace is dizzying, you may not be alone. There are ways to get a better grasp and to reduce the anxiety. Start with the primary sources. Read the frameworks alongside the incidents. Talk to me, or to people like me, willing to say “I do not know” when we do not know. That is the fastest route to clarity, and it comes at no cost to anyone willing to ask the question.
Sources
[1] Associated Press, OpenAI government-website disclosure
[2] ABC News, PM Albanese on Medicare portal
[3] CNN, rogue OpenAI agents targeting US government websites
[4] The Hacker News, Russian state-sponsored operators rebuilding malware
[6] CNA, Singapore’s UN proposal on AI safeguards
[7] Alabama Attorney General, investigation announcement
[8] OpenAI, Hugging Face incident and the road ahead
[9] Anthropic, investigating three incidents
[10] Anthropic, alignment assessment
[12] Transluce, early rogue AI-agent activity
[13] Mr Jensen Huang and Senator Bernie Sanders on AI containment
[14] Professor Nick Bostrom on AI panic
[15] Professor Geoffrey Hinton on UN warnings
[16] Mr Jeffrey Goldberg and Mr Josh Tyrangiel
[17] Grey Orbits, The Cunning (AI) Fox
[18] Stanford photo-swap story
[19] The Hacker News, Zero Trust for AI Agents Starts With Fixing Zero Visibility
[20] Grey Orbits, PETALS™ Framework
[21] Mr Marin Ivezic, quantum AI data centres in space
[22] Mr Marin Ivezic, paying for AI’s data centres
[23] Grey Orbits, A Weekend Note
[24] Mr Piyush Gupta on ten minors
[25] SMU Executive Development, DFAI programme
About the Author
Viren Mantri is a cybersecurity and risk advisor and former senior technology leader across Standard Chartered, UBS, McAfee, and KPMG. Three decades at the intersection of technology, cyber, governance, risk and AI, most of them inside regulated banking, now applied to helping organisations cut through complexity and make better security decisions.
CC-BY Viren Mantri, 2026, licensed under a Creative Commons Attribution 4.0 International License.
Disclaimer: All views expressed here are entirely mine.