AI Will Always Find a Way

Last weekend, AI security firm Nightingale Group revealed that a swarm of AI agents that were supposed to have read-only access to the internet found a way to write anyway. They took over the message boards of a dormant German wiki site for developers, impersonated its moderator, and used it to talk to each other — all just to accomplish the job they'd been handed. 

This incident happened months before AI agents hacked Hugging Face’s systems. It’s now a pattern. Two separate cases of autonomous agents finding an unintended path to get their job done, and there will be more. Nothing here is fundamentally new, but it drives home the one thing that should frame how you think about controlling AI: it will take any path it has available to get the job done.

These incidents highlight the opportunity and risk of AI. Even if you ask very nicely and put hard restrictions on it, if the gap is there, AI will find and leverage it (or exploit, depending on your point of view).

OpenAI’s Agents Turned Read-Only Access Into Write Access

In both cases, the agents ran in an OpenAI sandbox explicitly meant to limit agents to read-only communication with the internet. OpenAI implemented this read-only limitation by disabling POST requests. In simple terms, in HTTP communication (one of the internet’s core protocols) GET means “read” and POST means “write.” If the agents only have GET access, they can’t write or communicate with each other, right?

But we know it’s often not that simple with AI. It always finds a way. In the latest incident involving a site called DseWiki, agents realized they could practically POST using just GET requests. It wasn’t exactly a vulnerability, but it clearly bypassed the intended use of GET requests to successfully “exploit” this gap. The underlying issue was with the site’s code, so it couldn’t be enforced from the sandbox.

Once this happened, every agent in the swarm found the site and understood they could use the same trick to communicate with each other. They became a swarm, making 15,000-plus edits to the wiki to share answers. They impersonated the site’s moderator and even attempted XSS attacks on the site to maintain this valuable means of communication and expand their web capabilities.

Agents Can Cause Problems Without Bad Intent

The ironic part is that the agents did this all without malicious intent. They were simply attempting to answer web search questions as part of a timed test, and they did EVERYTHING they could to get the job done. Isn’t this what we expect our AI to do? To not be lazy, to think outside the box, to find a way through?

Well, as it turns out, not everything-everything. There are some actions we don’t want these agents to take, even if it would help them deliver what we asked them to achieve. Ideally we’d like to steer them in the right direction when they’re going off track rather than stopping them in their tracks. This is the way to look at guardrails: not to block prompts, but to stop “bad” behavior so “good” behavior can take its place.

The Importance of Understanding Intent

And this happened with the smallest possible blast radius. The experiment agents in the latest incident were all clean-slate agents, so they had no access to sensitive company information or systems. Imagine that same “POST through GET” happening on an agent with access to your company’s critical business secrets: unreleased financials, source code, customer data. One oversight and that information is accidentally spilled all over the internet.

This is where Cyera comes in. Our platform detects intent drift: cases where the agent diverges from the intent of the user (even if unstated at times, like “don’t delete this DB to optimize it”) or cases where the agent diverges from the organization’s intent (like “don’t hack websites”). Technical boundaries are still very important and effective, but with AI you need to secure intent as well. AI will always try to find a way, so you need to make sure it’s only considering the approved paths.

There are fundamentally three ways intent can drift:

1. Agent-user: When the agent does something the user didn’t intend for it to do. For example, if the user asks the agent to clean up their inbox, and the agent infers the best way to do it is to simply delete every message.
2. Agent-organization: When the agent does something that violates company policy or regulation. For example, an agent puts customer data in plain text within a report it’s making, even though it’s just meant for metadata analysis.
3. User-organization: When the user’s original ask violates company policy or regulation. For example, an employee trying to collaborate with a contractor and looking to speed up the project wants to share sensitive IP with them, essentially exfiltrating the company’s crown jewels.

At Cyera we’re watching out for all three, and their internal sub-cases. Cyera’s runtime engine uses the context from all three and inspects each action in the agentic loop, then either alerts or blocks the action depending on how you set up your policy. Even when a specific action gets blocked by the guardrail, the agent could continue operating within boundaries. In essence, Cyera’s Agent Guardian is a guardrail enabling you to use AI to its fullest potential while still helping you reduce the biggest risks it presents.