Pillar Security CEO wants AI agent limits enforced outside the model after the OpenAI escape

Ziv Karliner, co-founder and CEO of Pillar Security, wrote in an SC Media Perspectives column that the incident "exposed the limits of our understanding of how AI agents behave when given substantial autonomy to complete a task" ^[3][10]. In this case the models under test were the ones that crossed the boundary ^[1]. The column does not describe the escape path or include an example of an agent reasoning its way past a prompt instruction.

The cases it does cite failed at the enforcement layer. Sandbox isolation is already a control outside the model. In the seven case studies it broke where it trusted coding tools and IDEs running beyond the sandbox ^[2]. That supports enforcing limits outside the model, on one condition: the outside layer has to be tested at every point where it trusts other software. Karliner's test list does include surrounding software, alongside the model, its tools, credentials and network access ^[14].

His argument for hard limits over soft ones rests on a worked example. An agent reconciling invoices may read financial records and propose corrections. Changing a vendor's bank details or issuing a payment is a different class of action. It should need separate authorization even if the agent concludes that doing so would resolve the discrepancy ^[7]. That distinction has to exist in the tools, credentials and access controls, "not merely in the prompt," he wrote ^[7]. "A policy an agent's expected to follow is not the same as a control that prevents it from acting," Karliner wrote ^[8].

I think the controls he lists are standard least-privilege practice, applied to a caller that decides its own steps ^[11]. Each agent gets credentials limited to its task and, where possible, to a time window ^[4]. Workloads are isolated, network access is restricted, and every tool action is checked against explicit permissions before it executes ^[4]. Payments, permission changes and transfers of sensitive data need additional authorization or human approval ^[5]. "A model's determination that an action would help complete its task cannot confer permission to take it," he wrote ^[6].

The sequencing is the sharper demand. Before an agent touches systems, credentials or sensitive data, Karliner wants teams to watch what it does when its task is blocked, a tool fails or untrusted content tries to redirect it. They should also confirm that attempted violations are actually stopped ^[14]. After deployment, logs should reconstruct what the agent attempted, what was allowed and what was blocked. Teams should confirm they can revoke credentials and terminate workloads, and should make one person responsible for alerts. The tests get rerun whenever models, tools, integrations or permissions materially change ^[9].