Recent news stories about AI agents escaping their sandboxes to target external platforms such as Hugging Face highlight the new world we live in with autonomous AI.
These incidents raise a fundamental question: how can a sandboxed agent use an approved network connection to reach systems it was never meant to access?
When stuck on a task, autonomous agents have demonstrated the ability to systematically reason their way around restrictions. In the Hugging Face case, an agent leveraged a routinely approved connection to an external software repository as its escape vector, then chained vulnerabilities together to secure full administrative privileges.
Sandboxes rarely fail because of what an agent does internally, but rather because of what remains reachable at the edges. System prompts, application guardrails, and harness restrictions are necessary, but they are behavioral controls. And behavior is what an autonomous system can reason its way around. Containment must be enforced at the infrastructure level through network architecture and strict identity controls.
As teams deploy agentic AI into production, securing outbound connectivity is no longer theoretical. It is a baseline deployment requirement.
Agentic AI: tool or employee?
As AI evolves, organizations must rethink how they manage access control. While AI agents are often deployed as tools, their ability to take autonomous action means they cannot be governed by traditional software permissions alone, nor treated like standard employees. Instead, organizations must treat them as a new class of non-human identities whose access depends on how they operate.
When a human is actively directing an agent, the agent is effectively a tool. The person should delegate their privileges for the duration of the task, and every action should trace back to them.
When an agent runs autonomously, handling events or executing on a schedule, it acts more like an employee. Just as a security team wouldn’t hand a brand-new hire broad admin privileges on day one without oversight, autonomous agents cannot be given free rein over network infrastructure.
The difference is speed. A human employee with too much access is a slow-moving risk. But an agent with the same access can turn that risk into a full compromise in minutes, trying one path after another without pausing to ask whether it should. For example, average human breakout times range between 60 and 84 minutes; automation-fueled attacks have dropped to 29 minutes, with the fastest observed attack taking minutes.
Governance and lifecycle
Treating agents like employees starts with identity. Each agent will need its own unique Non-Human Identity (NHI) with scoped, short-lived API tokens and defined service accounts, not static, shared admin keys. Unique identities show which agent did what and let teams cut off one agent without affecting the rest. From here, apply the lifecycle discipline organizations already use for employees:
- Onboarding: Establishing role-based access before the agent goes live, covering exactly the applications, data stores, and services it needs to reach.
- Job Changes: When an agent takes on a new task, re-scope its access rather than adding to it.
- Offboarding: When an agent is retired, or an anomaly is detected, network paths and token access should be instantly revoked.
More than guardrails
Identity determines who an agent is, but network policy determines where it goes. Securing agentic AI requires strict filtering, traditional network security and access controls, and zero-trust policy to enforce movement automatically.
This starts with visibility. Security teams can’t contain an agent without knowing which applications it depends on and which connectivity paths lead somewhere they shouldn’t. Automated asset discovery maps the application connectivity agents rely on across hybrid estates, and continuous compliance monitoring raises real-time alerts when an agent attempts to reach beyond its sandbox.
However, visibility isn’t enough. Micro-segmentation and identity-based access controls let agents reach the specific databases or internal services required for their job function, without giving them lateral access to adjacent environments. In the Hugging Face case, the critical failure wasn’t that the agents had network access at all; it was that a component approved for one purpose became a bridge to the outside world.
Lastly is scale. Security teams can’t manually review every network rule change an agentic platform requires. Automated policy change management removes this bottleneck by instantly translating security intent into firewall and cloud security group rules, checking each change for risk, and keeping an audit trail of what changed and why, so teams can move at the speed that agentic AI demands without giving up control.
Guardrails guide, networks govern
Guardrails shape what an agent tries to do, but network architecture and identity controls determine what it can actually do. To safely harness the power of agentic AI, organizations need both. They must pair behavioral guardrails with strict infrastructure containment, treating AI agents as distinct digital employees that require the same security boundaries as any human employee.
If applied earlier, this same discipline of mapping exactly what an agent can reach and enforcing it at the identity and network layers could have limited the agent’s available path or blocked its progression before reaching Hugging Face.
Organizations that build visibility and connectivity discipline into how they deploy agents now won’t be the ones explaining a preventable breach twelve months from now.
