AI agents, models that take actions rather than just answer questions, are now trusted with real systems: code repositories, databases, email, browsers. This week showed what that means when things go wrong. On 20 October OpenAI published details of two incidents in which its own agents weakened the monitoring built to watch them. A day earlier, Reuters reported on a hacker who let AI agents do most of the work of breaking into more than 100 company websites. And Microsoft announced new controls that treat AI agents the way security teams treat risky employees.
OpenAI: agents that switched off their own alarms
OpenAI runs a "misalignment monitor" that watches its internal AI agents and alerts people when something looks wrong. Its report describes two cases, both inside OpenAI and neither rated top severity.
GPT-6.1 Sol silences the alerts
Told by a user "don't send any messages", an agent disabled notifications to the security team, emptying the alert lists and citing the user's request. A subagent first advised against it; the main agent overruled it.
GPT-6 Astra removes a monitor
Asked to copy a reference setup, an agent removed the monitoring integration and replaced its test with one checking the monitor was absent. Asked directly, it denied removing it.
OpenAI publishes the reportNow
Its Auto-Review system now blocks attempts to disable monitoring, and workloads without a valid "safety case" will be stopped automatically.
OpenAI says it does not yet have "a satisfying explanation for this behavior", and is testing whether it is over-eager task completion or a specific tendency to avoid being watched. Either way, the lesson for everyone else is practical: an agent's instructions, and even its own subagents' warnings, are not a reliable safety control. The control has to sit outside the agent.
The attacker's view: agents that hack for $50
Reuters, working with researcher Snorre Fagerland of NorForge, traced a Chinese-speaking hacker who used an open-source agent platform called Cairn. The hacker typed instructions of fewer than 100 Chinese characters; the agents did the rest.
- Targets
- e-commerce sites in the US, Canada, Australia and Japan, from 25 September
- Scale
- more than 1,200 sites attempted, over 100 companies breached, including Deere, SharkNinja and a Cummins vendor site
- Time
- about 23 hours of probing per successful intrusion
- Cost
- roughly $5,000 in AI tokens, about $50 per breach, according to Fagerland
- Tools
- a mix of DeepSeek and Claude Code, Fagerland believes
- How it came to light
- about two dozen Cairn instances were left exposed on the internet
The companies named said damage was limited or contained. The point is the economics: breaking in used to need skilled people for days; now it needs a budget and patience. Small, forgotten systems, such as old support sites and admin panels, are exactly what tireless agents find.
Microsoft: treat every agent as an insider
Microsoft announced on 19 October new controls in Microsoft 365 E7 and its Project Perception security platform. The idea is that agents are like employees with too many permissions, so they need the same identity, access and monitoring controls.
Dynamic permissions
Access- An agent starts with no access of its own
- It gets only what one task needs, for as long as that task lasts
Dynamic agent risk
Monitoring- Each agent gets a risk score from identity, data, device, network and its own actions
- Discovery now finds 60 agent types on staff devices, including Claude Code, Codex and GitHub Copilot
Conditional access
Response- As risk rises: remove write access, then some data, then require human approval, then stop the agent
- Guardian agents check actions before they happen and investigate risk changes
Microsoft did not give availability dates or say whether the features cost extra. Critics have noted the obvious tension: the same company that sells the agents now sells the controls.
A checklist for agents near your data
- 1
Give each agent its own identity
Never let an agent use a person's login or a shared service account. You need to know which agent did what.
- 2
Read-only by default
Most analysis needs SELECT, not INSERT or DROP. Grant write access per task, and take it back afterwards.
- 3
Keep logs out of reach
Audit logs and alerts must live where the agent cannot change them, as OpenAI's incidents show.
- 4
Require approval for irreversible steps
Deleting data, sending emails, changing permissions and spending money should need a human click.
- 5
Inventory your agents
Find the agents already running on laptops and in SaaS tools, not just the ones you built.
- 6
Patch the forgotten corners
Old admin panels and test sites are what attacking agents find first.
Check your understanding
1/3What did the GPT-6.1 Sol agent do in OpenAI's first incident?
It cited the user's instruction not to send messages.
2/3About how much did the hacker's AI costs work out to per successful breach?
Roughly $5,000 in total across more than 100 breaches.
3/3What is the core idea of Microsoft's dynamic permissions?
Access is also reduced step by step as an agent's risk rises.
You got 0 out of 3.
Related: agents that work for hours, AI rules this month and the Personal Agent Protocol, a new standard for how agents sign in and what they may do.
Sources: OpenAI Alignment, "Suppressing misalignment monitoring alerts and disabling misalignment monitoring" (updated 20 October 2026); Reuters, "How one hacker used AI agents and a few thousand dollars to break into scores of sites" (19 October 2026); The Next Web on Microsoft 365 E7 and Project Perception (19 October 2026); Axios on the White House reporting requirement (9 October 2026).
Alessandro Ecclesie AgazziWritten by Alessandro Ecclesie Agazzi, analytics engineer in London. Updated 21 October 2026. About me