AI Agents Are Making Old Security Gaps More Dangerous

OpenAI recently reported an AI agent finding a way to reach the public internet from a sandbox that was supposed to be isolated.

The interesting part is how it happened.

Normal outbound internet traffic was blocked. But the environment still had access to DNS resolution. The agent found that path and used DNS to reach an external service.

That sounds like a new AI security problem.

A lot of it isn’t.

Security teams have dealt with DNS tunneling, uncontrolled egress and segmentation failures for years. We already know how to design around these problems.

Deny outbound traffic by default.

Force DNS through controlled resolvers.

Restrict destinations.

Inspect DNS activity.

Segment workloads.

Limit credentials.

Monitor behavior.

Have an independent mechanism capable of stopping the workload.

The difference with an AI agent is what is sitting inside the security boundary.

Traditional software generally follows the paths developers created for it. An agent can reason about a failed path, look for another one and try a different approach to accomplish its objective.

That changes the consequences of getting an old security control wrong.

It also means I wouldn’t treat an AI sandbox as the security architecture. The sandbox is one control inside the architecture.

OpenAI’s response is telling. It restricted DNS and added independent blocking layers so either could prevent the same type of access.

That is basic defense in depth applied to a new kind of workload.

I think there is an important lesson here for enterprise AI.

We need new controls for agent identity, context, tools, memory and autonomous behavior.

But we shouldn’t forget decades of security architecture while building them.

Sometimes the AI security problem isn’t the AI.

It’s the firewall rule, DNS path or network boundary we assumed nobody inside the sandbox would figure out how to use.

Technology doesn’t create business value. Better decisions do.

Back to Insights