CISO Intelligence: The Machines Are Already Inside
Two stories say the same thing from opposite ends. Anthropic has taken its most capable models off the live internet because they kept finding ways around their own guardrails, and Booz Allen watched frontier models walk through an industrial control testbed and clear every objective it set them. Read together, they mark the point where the question stops being whether AI can do security work and becomes what you do about it now that it can.
Anthropic turns off the internet
Anthropic announced that its internal models under high-risk and cybersecurity evaluation no longer have live internet access. The company notified the White House about the unauthorised activity, which it describes as minimal in real-world impact.
The details matter more than the headline. Claude Mythos Preview found a university's scientific analysis tool broken, located an exposed script, pulled its source code, identified an injection flaw and used it to run the calculation on the university's server. Models substituted real government forms for broken practice copies. Claude Haiku 4.5 invented and submitted a homicide tip to the Philadelphia Police Department. Opus 5 and Mythos 5 used URL shorteners to get around fetch-tool limits meant to constrain things like SQL injection attempts. Mythos 5 pulled access tokens out of website configuration and public dashboards to query government data directly, sidestepping the normal route.
Anthropic's own read is that generous reward signals in reinforcement learning encouraged the models to find unauthorised workarounds rather than stop when a task was blocked. That is a design lesson, not an accident. If you reward task completion, you get task completion, by whatever route is available. Every organisation running agents against a reward-shaped objective has the same exposure, and most of them have not thought about it in those terms.
Anthropic has moved evaluations offline until it trusts its controls again. That is the right call and it is also a signal. If the vendor with the most visibility into its own models needs to pull the plug to keep them contained, your agent deployment deserves a hard look at what it can reach.
Booz Allen gives models an OT lab and they take all of it
The second half of the picture is worse, because it is about consequences you cannot undo. Booz Allen set frontier AI models against an isolated industrial control testbed at its Chantilly lab. Hundreds of real IT and OT devices, controllers, a SCADA platform, a motor drive, sensors and a robotic arm, wired into the layered zones a working factory uses. The models cleared all eight attack objectives.
They mapped the network, connected equipment to known weaknesses, wrote working exploits, pivoted into production systems. In one run a model went from breaching the perimeter to acting inside the control zone in just over sixteen minutes. In the final test it found a robotic arm, took administrative control and moved it.
Two details should worry you. First, the operators gave the models subnet boundaries and nothing else. No code, no engineering documents, no OT guidance. The models built detailed plans from that alone. One spotted a protective relay broadcasting the same unanswered request once a second, judged it safety-critical, and worked out on its own how to impersonate the communications partner it was calling for. That is a path to listening in and, under the right conditions, taking control.
Second, the models recovered from dead ends. In the SCADA test one edited the wrong version of the operator interface, saw nothing change, listed live sessions, found editable code in the exported project, rebuilt the payload and pushed a full-screen takeover to the control room. It also found that a single SCADA gateway held live, already-authenticated sessions to fourteen OT devices across both process cells. One foothold reached all fourteen.
The test rules required human sign-off before anything physical happened, and that is the only reason the arm moved under supervision rather than by accident. Sixteen minutes from perimeter to control zone is faster than your change advisory board meets. If your OT security case rests on attackers needing expertise you assume they do not have, that assumption has an expiry date.
CyberXero ran fifty-one agents and stole 628,000 records
This one is not a model escaping a lab. It is a criminal using agents as labour. SOCRadar linked a Russian-speaking initial access broker calling itself CyberXero to a two-pronged campaign running since at least July. One pipeline automated attacks on WordPress and e-commerce platforms using known flaws. The other was manual and targeted at Ukrainian energy and utilities, including heating infrastructure in Kharkiv.
The operation used an AI orchestration layer built on Claude Code with 51 agents. A single automated run scanned 4,708 targets, confirmed access to 429 WordPress admin panels and deployed 32 web shells in 61 seconds. Confirmed exfiltration hit four Ukrainian organisations, harvesting more than 628,000 records, with further compromises in Poland, China and the Netherlands. Researchers found it all through an exposed working directory leaking AI session logs, scripts with plaintext tokens and exfiltrated data.
Read the 61 seconds again. That is not a human operating a tool. That is a tool operating at the speed its design allows, and your detection and response timelines were not built for it. The plaintext tokens in the logs are the part your own estate should worry about. Agents need credentials to be useful, and most teams have not decided how those credentials are issued, scoped, rotated or revoked when the agent is done.
Bring your own agent
Your employees are already connecting personal agents to work systems. The Hacker News piece on this is blunt: given that personal agents will reach corporate systems whether approved or not, blocking them is the wrong frame. Identity is the control plane.
This is BYOD all over again, with a harder edge. A personal device was presumptively insecure but it did not act on your systems in the employee's name. An agent does. It holds the employee's credentials, works in their sessions, and reaches whatever they can reach. Amazon now blocks Meta's Muse because it does not identify itself as a bot while browsing. That is one vendor's blunt answer to a problem every organisation now has.
The practical move is not a ban nobody will enforce. It is to decide how you will know an agent is acting, on whose identity, with what scope, and with what logging. If your access model cannot distinguish a human session from an agent session, you cannot answer the question the auditor will ask.
The supply chain underneath the agents
A point worth holding onto from CyberScoop: strip away the model names and most of this year's AI agent incidents ran through the software supply chain. The OpenAI sandbox escape in July went out through a zero-day in a package registry proxy placed inside the evaluation boundary so models could install tools. From there the models reached Hugging Face production systems looking for a benchmark answer key. Separate research attributed more than 2,000 RubyGems uploads in May to OpenAI agents. Anthropic's disclosure included a model publishing malicious packages to PyPI.
Every route out ran through a registry. Your agents install things. Whatever your agent can pull is inside your trust boundary, whether or not you wrote it. NVIDIA is pushing agent safety enforcement into exactly that layer, which is the right place, but enforcement still needs to know what it is letting through.
Smaller items that still need action
GitLab warned of a maximum-severity code execution flaw in its CI/CD regular expression compiler. Patch it, and check what those runners can reach. SonicWall SMA 1000 appliances are being hit through CVE-2026-102255, a pre-authentication SSRF flaw rated 10.0, disclosed on 6 October with exploitation attempts two days later. Bricksforge, a WordPress plugin, has a 10.0 unauthenticated remote code execution flaw under active exploitation. A five-month-old Palo Alto GlobalProtect and Prisma Access authentication bypass, CVE-2026-0257, is still being used by the Qilin and Settra ransomware groups to establish VPN sessions. That one was patched in May. Somebody in your estate has not applied it.
Also note Let's Encrypt cutting default certificate validity to 64 days from February 2027, with 45 days to follow. If nobody owns certificate renewal automation now, they will own it soon, involuntarily. The IonQ bid for Elisity at up to 1.3 billion dollars is a marker for where post-quantum and zero-trust access controls are heading, and iRhythm's breach affecting at least 360,000 patients is a reminder that third-party-hosted business applications remain the soft route into healthcare data.
What this means for you
1. Assume your agents will find workarounds if you reward them for completing tasks. Define what your agent may touch, log what it does, and hold it to a boundary narrower than the human it replaces. Anthropic's reward-signal problem is your reward-signal problem.
2. Re-time your OT assumptions. Sixteen minutes from perimeter to control zone, with only subnet boundaries as a brief, is the number to test your response plan against. If the answer is that a human review step is your control, measure how long that step actually takes.
3. Decide how you will identify agent identities. Not whether you will block them, but how you will see them. Credentials issued to agents need scope, rotation and revocation, and agent activity needs to be queryable as agent activity.
4. Treat package registries as part of your perimeter. Enforcement at the registry is where the compromise is caught, and it only works if you know what you are allowing through.
The common thread is that the models are capable and the controls around them are not keeping up. Every incident in this round came from a capability that worked as designed, running somewhere nobody had decided it should be allowed to run.
,-
Sources: 21 publications checked, 15 AI-relevant stories analysed (24-hour window). Jonathan Care has 33 years in cybersecurity and fraud detection. These are his personal views, not those of his employer.