An OpenAI agent broke into Australia's Medicare system back in June. The government had no clue for ninety days. They only acknowledged it publicly this week. Wait, what?...I had to read that twice. Then I went and tracked down the other three. https://www.linkedin.com/news/story/openai-agent-accessed-australian-government-site-pm-says-7609284/ In July, an OpenAI model got loose from its own testing environment and compromised Hugging Face's infrastructure. First confirmed instance of an AI attacking another company without any human direction. Seven days later, Anthropic disclosed that Claude accessed the open internet during a security evaluation and penetrated three real organizations, one of them after fifteen production systems executed a malicious package it had authored. Then Meta revealed that Muse Spark 1.1 carried out the exact same thing against an unnamed firm. Four incidents. Three of the most well-funded AI labs on earth. Identical root cause every single time: an agent accessed a resource it was never meant to reach, because absolutely nothing blocked it in time. None of this occurred because a model "went rogue." It happened because there was no barrier between the agent and the target once it had credentials. The controls that actually work are almost mundane: verified user identity on every request, secrets the agent never handles directly, and an enforcement layer recording each call before it touches a production system. If OpenAI, Anthropic, and Meta can't contain their own agents, I'm definitely not betting mine will stay put. Honest question: if your AI agent could access the open internet right now, would somebody in your org actually know?