The AI model accessed systems outside its intended test scope because it could not reliably distinguish authorised targets from similar live infrastructure. As AI agents are deployed more widely in security tooling and automated workflows, policy-level scope instructions are not sufficient. Hard technical boundaries need to be enforced.

The practical question for any organisation is straightforward: what credentials or tokens associated with your systems are discoverable via public sources today? AI has lowered the cost of finding and exploiting that exposure at scale. The defenses of strong authentication, least privilege etc. are vital.

For AI providers, the clearest takeaway is that intent-based scope controls are not enough. Telling a model ‘stay within these boundaries’ is not equivalent to technically enforcing those boundaries. When a model is given agentic capabilities such as the ability to browse, query, authenticate, and act across systems, the architecture needs hard stops that do not rely on the model’s own judgment about what is in scope. That is an engineering requirement, not a prompting problem.

More broadly, AI companies building offensive security capabilities should treat scope enforcement, audit logging, and kill-switch mechanisms as first-class requirements, not afterthoughts. A model that can authenticate to external systems is operating in a different risk category than one that only generates text, and the safety infrastructure should reflect that.