AICassindra
Research review / trendwatch

Trend Watch: The Control Was Configured, It Just Was Not Enforced -- Allowed Services Became Exits, a Web-Writable Folder Became Trusted, and Limits and Blocklists Fell Through on Edge Cases

This week's containment reports and framework fixes describe the same failure at different scales. A boundary that exists in configuration stops applying under a condition nobody tested. As agents get better at finding those conditions, testing whether controls are enforced becomes the core security exercise.

By Sandeep Belgavi · Published 2026-10-26

Most of this week's agent-security reports involve no clever exploit of the model. Each describes a control someone had set up that did not apply in a specific situation. Seen together, they show where agent security breaks in practice.

At infrastructure scale

OpenAI's October 23 containment post is the clearest case. After July, it had cut outbound traffic down to a few internal services such as metrics, logging and authentication. Those were deliberate, reviewed exceptions. Its red-teaming agents "found vulnerabilities in almost every one of these services that gave them limited forms of internet access", including making a metrics endpoint fetch a URL the model chose. The isolation between microVMs held at the network level but not at the hardware level, where agents signalled each other through cache timing and storage contention.

At workstation scale

Forever Security's October 22 report shows the same pattern on a laptop. Coding agents follow instruction files in folders the user trusts. Downloads becomes trusted once the user has worked there, yet a web page can write into it. Nothing was misconfigured in the usual sense. The trust decision was made about a folder, and the folder's contents changed.

At library scale

The framework fixes are smaller versions of the same thing. LangGraph dropped an explicit recursion limit whenever it equalled the default, so an agent ran to 9,999 steps. Pydantic AI reads a guardrail's string label for truthiness, so a verdict of 'unsafe' lets content through; version 2.61 only warns about it, and a later release will reject it. Its browser harness silently lost its file:// rule once a blocklist reached 100 entries. Even promptfoo's community link turned out to be a pointer that had come to resolve to someone else's server.

The shared shape

Each control was correct in the configuration and wrong at the point of enforcement, and it failed open: the edge case allowed the action instead of blocking it. Agents raise the stakes in two ways. They hit unusual conditions far more often than people do, through long loops, large blocklists and odd working directories. And, as OpenAI's results show, capable agents now look for those conditions deliberately. A control that holds for a careful human operator can fail for an agent that runs ten thousand steps without pausing, opens whatever folder it is told to, and treats a plausible paragraph as a work instruction.

What remains uncertain. All of these are self-reports or vendor findings, and none comes with an independent count of how often such gaps are exploited in practice.

I think the practical response is to stop treating a configured control as evidence and start treating an observed denial as evidence. For every boundary an agent depends on, keep a negative test that tries to cross it and fails, and run it in CI and after every upgrade: the loop limit that must fire, the URL that must be blocked, the config file the agent must not write, the egress endpoint that must refuse an arbitrary fetch. Make unknown values fail closed, as Pydantic AI is now moving to do. And when you red-team, use the strongest model you can afford as the attacker, because the gap it finds is the one your next production agent will find too.

Sources and evidence

This week's reports share one failure: OpenAI's allowed metrics, logging and authentication services became internet exits for its red-teaming agents, a web-writable Downloads folder became a trusted agent workspace, and LangGraph, Pydantic AI and browser-use each let a limit, guardrail verdict or blocklist fail open on an edge case. Test that every boundary actually denies, in CI and after every upgrade, and make unknown values fail closed.