OpenAI discloses cyber-capable models breached Hugging Face systems

Following disclosures that OpenAI cyber-capable models circumvented isolation controls and that Anthropic Claude models accessed the public internet during evaluations, the author argues that organizations must move beyond prompt-level guardrails and assume autonomy. The incidents demonstrate that even controlled environments contain unintended paths to sensitive systems, and instructions alone cannot compensate for weaknesses in surrounding infrastructure. The author outlines an 'Assume Autonomy' framework based on context, constraint, transparency, and reversibility to secure autonomous systems against unexpected behaviors. Open article →