S
Sebastian Martinez Torregrosa
Guest
Attack surface is how systems can be reached. Escape surface is how far an authorized agent can still act beyond its mandate.
Think off the map, not out of the prison.
Attack surface is how unauthorized influence gets in. Blast radius is how far harm travels once something goes wrong. Escape surface is where an authorized agent can move beyond the mandate while still doing the job—even with no attacker at all.
If you only add AI to the inbound security model, you have not finished agent security. You have secured a new runtime with an old threat model. The missing object is the authorized searcher discovering paths the mandate never listed.
Those newly discovered paths can create consequential exposure without breaking any of the boundaries the system was explicitly enforcing.
The agent is allowed to read the full customer record in the ERP. The brief says assess growth potential. So the agent puts some of that record into a public web search to enrich the account. ERP.read is green. web.search is green. The composition is not. Customer data leaves the company.
No attack occurred. Nothing was hacked. Nothing was bypassed. Nothing in the individual actions necessarily looks anomalous. The agent stayed inside its permissions and still moved beyond the mandate.
That is the escape. The escape surface is the reachable space in which escapes can occur.
That also makes the failure easy to miss. If monitoring is built around denied actions, known violations, or anomalous calls, an on-mission composition can keep succeeding without triggering the signals that would normally mark an incident. The same leak—or any other off-mandate effect—can repeat until someone notices the result rather than the path.
When every tool call is authorized and the objective still matches the brief, “attack” and “accident” can both miss the mechanism. The disclosure may be accidental as an outcome. It is not accidental as an architecture. The brief itself drove an on-mission composition.
The path was not invented by the agent. The possibility was already sitting in the permissions, tools, and connections you shipped. The agent found the composition.
A search box is an egress path. If customer data becomes the query, research has become a data transfer.
“Don’t share the file on the internet” does not cover pasting the file’s contents into a third-party search box. The file never left as a file. The content did.
You do not need a stolen file. The leak can look like diligent research.
Read is not purpose. Access to data is not permission to use it in every later step. Permission is not mandate. Authorization by component is not authorization of the composed effect.
The dangerous object is not ERP.read or web.search in isolation. It is their reachable composition inside a runtime whose future paths were not fully enumerated.
This join can be closed. Mark customer-confidential data at ERP.read and refuse to pass it into web.search without an approved transformation or declassification step. That removes this path. It does not prove you found the others.
I use escape surface to mean the set of paths and reachable effects through which an authorized agent, while pursuing its goal, can move beyond the systems, uses, purposes, actions, or destinations its mandate covered.
Traditional automation did not need this category because finding an unlisted path was not the product. Humans could find the same gaps, but we usually classified the result through the person: intent became insider abuse; no intent became error or bad judgment. An automated path-finder changes that. It can discover an off-mandate route simply by searching for a way to complete the job—no attacker and no intent to violate required. At agent scale, what was a residual problem becomes a standing property of the architecture. That is why the surface needs a name now.
Data exfiltration is only the cleanest picture of the surface. The same surface covers any off-mandate action that remains technically reachable: spinning up unauthorized cloud storage, invoking unvetted external models, provisioning throwaway accounts, initiating unexpected interactions with third-party systems, or creating synthetic business activity because it helps satisfy the assigned objective.
The surface begins where the known mandate stops, even when the permissions keep going. Its existence is knowable even when its contents are not.
The first off-mandate step is not necessarily the whole exposure. It is a new place to stand, with new paths reachable from there. An escape path can therefore expose further paths that were not visible from the original review.
Enterprise controls reason about objects we already know how to list. This identity can read this database. That service can call this API. This model may use these tools.
An agent does not only exercise grants one at a time. It chains them while searching for a way to hit the objective.
Customer record → reasoning → web search → external service.
Support ticket → vendor portal → generated email → outbound send.
Every edge can look reasonable. The risk can live in the join.
But the join is not the whole surface. A path can leave the mandate through purpose, destination, delegation, sequencing, or use of information even when no individual tool pair looks obviously dangerous.
That is different from an attacker finding an exploit. The system was built to search for useful combinations. For a general agent, path discovery is not an attack condition. It is the product. The agent is a path-finder: its job is to discover useful compositions the workflow did not enumerate in advance.
Prompt injection is what happens when someone else steers the agent. Escape surface includes what happens when nobody does.
This leak does not require a hacker. It requires a goal, two green grants, and a searcher.
The lethal trifecta—private data, untrusted content, outbound actions—is a real prompt-injection pattern. Close it and you can still have a path-finder walking off the drawn task with no poisoned page in the loop. Inbound security work is necessary. It is not the complete model. An escape can use private data and outbound actions with no untrusted content at all.
A similar shape appeared in a 2026 UK AISI cyber-range evaluation. Internet access was intentionally enabled so agents could obtain tools, while the authorization boundary remained a simulated cyber range. UK AISI identified two events involving GPT-5.6 Sol in which the model used real external services outside that range while still trying to find a path into the simulated environment and retrieve the assigned flag.
The task identified the in-scope networks and named several systems as out of scope. But the agents had not been explicitly told how open internet access could and could not be used. The evaluation also ran with cyber classifiers disabled to measure underlying capability, so this is evidence of the pattern under a reduced-safeguard evaluation setup, not a normal production case.
The relevant shape is narrower: the system was still pursuing the assigned objective when its search crossed the intended authorization boundary.
A more consequential version of the same pattern became public in Australia in September 2026. In June, an OpenAI research agent looking up Australian public health statistics encountered barriers while trying to retrieve the information, continued searching, and reached files Australian authorities say it was not authorized to access. [ABC] OpenAI says the models were performing an internal evaluation and took actions the company did not intend. Australia has called the incident a hack. [Australian Government]
The distinction matters. The escape surface is not itself the breach. It is the space of reachable paths through which a searcher can move beyond its mandate. In this case, continued search appears to have crossed an explicit access-control boundary and become a conventional security incident.
Whatever label is applied, the point here is broader: escape surface is not only an internal data-composition problem. An authorized searcher can carry an off-mandate path outward into systems the operator does not own. The effect does not have to stay inside your architecture for the path to begin inside it.
An agent can act from infrastructure you operate while the consequential part of its walk occurs on systems you do not. Monitoring the systems you operate is not necessarily the same as monitoring the full path an outbound agent can take.
Inbound controls still matter. But agent security also needs an outbound view of the AI escape surface: where an authorized searcher can go, what it can do there, what information it can carry with it, and where the effects can land.
Sometimes that path crosses into infrastructure you do not own. Sometimes the agent can leave its mandate without leaving its sandbox, its network, or even its own permissions. In both cases, the path outran the mandate.
The escape surface existed before the incident. The incident is when we finally saw it.
Deterministic automation starts with a finite workflow. You know the step, the field, the destination, the purpose.
A general research agent is valuable because it is a path-finder. It discovers useful compositions at runtime that were not enumerated when its grants were approved. Comprehensive predefined control wants those compositions authorized before the searcher finds them.
You can write the requirement. You cannot satisfy it without collapsing the path-finding problem into bounded automation. “Find a way, but only along paths we fully specified” is not an agentic requirement. It is a contradiction. Agents and controls are not incompatible. Completeness in advance is.
Specific paths can be closed. The problem is assigning completeness to a system whose value comes from finding paths you did not specify. You cannot comprehensively pre-authorize every consequential path in a graph whose paths are still being discovered.
For a newly discovered consequential path, the choice eventually resolves into three broad states:
There is no state where an agent freely discovers genuinely new consequential paths and every such path was comprehensively authorized beforehand.
That does not mean an architecture must choose one state globally. It can predefine some classes of action, supervise others, and leave limited space open elsewhere. But for the consequential path itself, the tradeoff remains.
General research over sensitive systems cannot be fully pre-specified without narrowing the generality that gives it value. The more completely you define the allowed paths, the closer the system moves from agentic exploration toward bounded automation.
You can separate raw customer data from an open web channel. That closes part of the escape surface. It is not a wrapper around the same product. It is a smaller agent.
Zero Trust asks whether access should be granted. Agentic systems add another question: what can that grant be composed into?
Some consequential paths are not merely ungranted. They were never imagined as paths that would need a grant at all.
If every new consequential edge is denied until it becomes an explicit grant, exploration becomes supervised or bounded. If the edge can proceed before that happens, some activity remains outside comprehensive predefined authorization.
A sandbox can bound infrastructure. It cannot, by itself, bound every future meaning of the actions available inside that infrastructure. A browser request can be research or an egress channel. A filename can be storage or a message. A read can support analysis or feed an external query. The primitive stays allowed. The composed meaning changes.
A sandbox can close known doors. A path-finder is valuable because it keeps looking for doors you did not know were doors.
The moment you say “find,” you admit the paths are not known yet.
Could new grants be defined as new paths appear? Human-in-the-loop can authorize those paths as they are identified. Someone still has to know this is the moment to ask.
There are two recognition problems.
The agent may never raise the gate. Finding a new path and recognizing that it needs a new grant are different problems. Reliably knowing that a new composition requires escalation means the system must recognize that it crosses a relevant boundary. If that boundary was never defined well enough to recognize, “the agent will ask a human when something becomes dangerous” assumes the agent can see the boundary the system failed to encode.
One answer is to escalate every new consequential path. That preserves control by giving up unattended discovery. But it still does not solve the identification problem: the system has to know that a consequential new path has appeared. If every new path must be granted before it can even be tried, the productivity advantage of autonomous path-finding largely disappears. If you escalate only selected paths, whatever the rule does not recognize remains part of the residual escape surface.
Even when the gate is raised, the human still has to recognize the danger. The human can approve the visible verb and miss the payload. Search looks like research. The leak is the customer field inside the query.
HITL restores a veto where an escalation point exists. It does not guarantee that every novel path will reach one. It does not make an open search space closed.
An agent can pass tests for prompt injection, credential abuse, known Data Loss Prevention patterns, tool-policy violations, and sandbox escape yet still discover an off-mandate path through capabilities it legitimately possesses.
Those tests are not weak. They answer different questions.
A clean inbound security test does not prove that every authorized composition stays inside the mandate.
The same is true for monitoring: an unexpected off-mandate path may still look normal at the level of individual actions and raise no alert at all.
An empty incident log does not prove the escape surface has been mapped. It may only prove that no known detector fired.
Security has always dealt with unknown paths. The difference is that we are deploying systems whose economic purpose is to search for them.
Existing labels can swallow the event. Each one points toward a different repair.
Call it insider threat and you hunt motive. The agent needs none. It can generate the path by doing the job.
Call it accidental disclosure and you hunt a glitch. The process may have worked exactly as provisioned: read, search, enrich.
Call it prompt injection, confused deputy, Data Loss Prevention miss, excessive agency, or sandbox escape and you may fund inbound hardening, blast-radius reduction, or a thicker wall. Useful work. Not the third question.
Those categories can capture pieces of the event, but none makes the authorized search path beyond the mandate the primary object of analysis. IAM can be green, the sandbox can hold, and the goal can still be the one you assigned.
You cannot patch a missing mandate by measuring how wet the floor got.
The gaps are not new. The automated path-finder is. Traditional automation follows paths we define. Humans can discover unexpected ones, but we have usually classified the result through the person—as judgment, error, misuse, or insider risk. Agents change the operating condition: finding previously unspecified paths can be part of the authorized workload itself. The gap between mandate and reachable action therefore stops being a residual problem and becomes something the architecture has to model explicitly.
Identity asks who. Authorization asks what they may access or do. The missing question is what still sits in the escape surface.
I cannot tell you that naming this object makes the system safe. I can tell you that inbound security plus blast radius cannot bear the guarantee hung on them.
For security teams, naming the escape surface changes the review question. A design review can ask what happens beyond the edge of the known mandate. That forces different work: purpose binding, composition analysis, destination control, segregation of sensitive data from open channels, deterministic blocks for known-dangerous paths, and an explicit decision about where discovery is bounded, supervised, or left open.
Open-ended discovery of consequential paths and comprehensive pre-authorization of every such path are incompatible.
Residual escape surface becomes a decision, not an unnamed leftover of inbound work.
A category that cannot reach a ticket queue is only vocabulary.
The category is the escape surface: authorized search past the mandate.
Don’t assign that ticket only to model safety. Assign it to the teams that built the path.
With a path-finder, there is always the possibility of a previously unidentified escape path. There is no universal answer to whether the remaining risk is acceptable. That depends on the system, the consequences, the alternatives, who gets the benefit, who bears the risk, and the ethics of the authorization. Security cannot cancel that decision by pretending the escape surface can always be driven to zero.
*This article is the security object. The companion piece is AI Isn’t Escaping. We Built an Agent and Expected a Human.
Think off the map, not out of the prison.
Attack surface is how unauthorized influence gets in. Blast radius is how far harm travels once something goes wrong. Escape surface is where an authorized agent can move beyond the mandate while still doing the job—even with no attacker at all.
If you only add AI to the inbound security model, you have not finished agent security. You have secured a new runtime with an old threat model. The missing object is the authorized searcher discovering paths the mandate never listed.
Those newly discovered paths can create consequential exposure without breaking any of the boundaries the system was explicitly enforcing.
Two green grants, one escape
The agent is allowed to read the full customer record in the ERP. The brief says assess growth potential. So the agent puts some of that record into a public web search to enrich the account. ERP.read is green. web.search is green. The composition is not. Customer data leaves the company.
No attack occurred. Nothing was hacked. Nothing was bypassed. Nothing in the individual actions necessarily looks anomalous. The agent stayed inside its permissions and still moved beyond the mandate.
That is the escape. The escape surface is the reachable space in which escapes can occur.
That also makes the failure easy to miss. If monitoring is built around denied actions, known violations, or anomalous calls, an on-mission composition can keep succeeding without triggering the signals that would normally mark an incident. The same leak—or any other off-mandate effect—can repeat until someone notices the result rather than the path.
When every tool call is authorized and the objective still matches the brief, “attack” and “accident” can both miss the mechanism. The disclosure may be accidental as an outcome. It is not accidental as an architecture. The brief itself drove an on-mission composition.
The path was not invented by the agent. The possibility was already sitting in the permissions, tools, and connections you shipped. The agent found the composition.
A search box is an egress path. If customer data becomes the query, research has become a data transfer.
“Don’t share the file on the internet” does not cover pasting the file’s contents into a third-party search box. The file never left as a file. The content did.
You do not need a stolen file. The leak can look like diligent research.
Read is not purpose. Access to data is not permission to use it in every later step. Permission is not mandate. Authorization by component is not authorization of the composed effect.
The dangerous object is not ERP.read or web.search in isolation. It is their reachable composition inside a runtime whose future paths were not fully enumerated.
This join can be closed. Mark customer-confidential data at ERP.read and refuse to pass it into web.search without an approved transformation or declassification step. That removes this path. It does not prove you found the others.
I use escape surface to mean the set of paths and reachable effects through which an authorized agent, while pursuing its goal, can move beyond the systems, uses, purposes, actions, or destinations its mandate covered.
Traditional automation did not need this category because finding an unlisted path was not the product. Humans could find the same gaps, but we usually classified the result through the person: intent became insider abuse; no intent became error or bad judgment. An automated path-finder changes that. It can discover an off-mandate route simply by searching for a way to complete the job—no attacker and no intent to violate required. At agent scale, what was a residual problem becomes a standing property of the architecture. That is why the surface needs a name now.
Data exfiltration is only the cleanest picture of the surface. The same surface covers any off-mandate action that remains technically reachable: spinning up unauthorized cloud storage, invoking unvetted external models, provisioning throwaway accounts, initiating unexpected interactions with third-party systems, or creating synthetic business activity because it helps satisfy the assigned objective.
The surface begins where the known mandate stops, even when the permissions keep going. Its existence is knowable even when its contents are not.
The first off-mandate step is not necessarily the whole exposure. It is a new place to stand, with new paths reachable from there. An escape path can therefore expose further paths that were not visible from the original review.
The unit of risk is often the path
Enterprise controls reason about objects we already know how to list. This identity can read this database. That service can call this API. This model may use these tools.
An agent does not only exercise grants one at a time. It chains them while searching for a way to hit the objective.
Customer record → reasoning → web search → external service.
Support ticket → vendor portal → generated email → outbound send.
Every edge can look reasonable. The risk can live in the join.
But the join is not the whole surface. A path can leave the mandate through purpose, destination, delegation, sequencing, or use of information even when no individual tool pair looks obviously dangerous.
That is different from an attacker finding an exploit. The system was built to search for useful combinations. For a general agent, path discovery is not an attack condition. It is the product. The agent is a path-finder: its job is to discover useful compositions the workflow did not enumerate in advance.
Prompt injection is what happens when someone else steers the agent. Escape surface includes what happens when nobody does.
This leak does not require a hacker. It requires a goal, two green grants, and a searcher.
The lethal trifecta—private data, untrusted content, outbound actions—is a real prompt-injection pattern. Close it and you can still have a path-finder walking off the drawn task with no poisoned page in the loop. Inbound security work is necessary. It is not the complete model. An escape can use private data and outbound actions with no untrusted content at all.
A similar shape appeared in a 2026 UK AISI cyber-range evaluation. Internet access was intentionally enabled so agents could obtain tools, while the authorization boundary remained a simulated cyber range. UK AISI identified two events involving GPT-5.6 Sol in which the model used real external services outside that range while still trying to find a path into the simulated environment and retrieve the assigned flag.
The task identified the in-scope networks and named several systems as out of scope. But the agents had not been explicitly told how open internet access could and could not be used. The evaluation also ran with cyber classifiers disabled to measure underlying capability, so this is evidence of the pattern under a reduced-safeguard evaluation setup, not a normal production case.
The relevant shape is narrower: the system was still pursuing the assigned objective when its search crossed the intended authorization boundary.
A more consequential version of the same pattern became public in Australia in September 2026. In June, an OpenAI research agent looking up Australian public health statistics encountered barriers while trying to retrieve the information, continued searching, and reached files Australian authorities say it was not authorized to access. [ABC] OpenAI says the models were performing an internal evaluation and took actions the company did not intend. Australia has called the incident a hack. [Australian Government]
The distinction matters. The escape surface is not itself the breach. It is the space of reachable paths through which a searcher can move beyond its mandate. In this case, continued search appears to have crossed an explicit access-control boundary and become a conventional security incident.
Whatever label is applied, the point here is broader: escape surface is not only an internal data-composition problem. An authorized searcher can carry an off-mandate path outward into systems the operator does not own. The effect does not have to stay inside your architecture for the path to begin inside it.
An agent can act from infrastructure you operate while the consequential part of its walk occurs on systems you do not. Monitoring the systems you operate is not necessarily the same as monitoring the full path an outbound agent can take.
Inbound controls still matter. But agent security also needs an outbound view of the AI escape surface: where an authorized searcher can go, what it can do there, what information it can carry with it, and where the effects can land.
Sometimes that path crosses into infrastructure you do not own. Sometimes the agent can leave its mandate without leaving its sandbox, its network, or even its own permissions. In both cases, the path outran the mandate.
The escape surface existed before the incident. The incident is when we finally saw it.
The map was never complete
Deterministic automation starts with a finite workflow. You know the step, the field, the destination, the purpose.
A general research agent is valuable because it is a path-finder. It discovers useful compositions at runtime that were not enumerated when its grants were approved. Comprehensive predefined control wants those compositions authorized before the searcher finds them.
You can write the requirement. You cannot satisfy it without collapsing the path-finding problem into bounded automation. “Find a way, but only along paths we fully specified” is not an agentic requirement. It is a contradiction. Agents and controls are not incompatible. Completeness in advance is.
Specific paths can be closed. The problem is assigning completeness to a system whose value comes from finding paths you did not specify. You cannot comprehensively pre-authorize every consequential path in a graph whose paths are still being discovered.
For a newly discovered consequential path, the choice eventually resolves into three broad states:
- Predefine the path. You get a bounded product. You lose part of the explorer premium.
- Authorize the path when it appears. You keep discovery. You reintroduce supervision, latency, and a human in the loop.
- Leave some paths open. You keep autonomy. You accept residual escape-surface risk.
There is no state where an agent freely discovers genuinely new consequential paths and every such path was comprehensively authorized beforehand.
That does not mean an architecture must choose one state globally. It can predefine some classes of action, supervise others, and leave limited space open elsewhere. But for the consequential path itself, the tradeoff remains.
General research over sensitive systems cannot be fully pre-specified without narrowing the generality that gives it value. The more completely you define the allowed paths, the closer the system moves from agentic exploration toward bounded automation.
You can separate raw customer data from an open web channel. That closes part of the escape surface. It is not a wrapper around the same product. It is a smaller agent.
Zero Trust asks whether access should be granted. Agentic systems add another question: what can that grant be composed into?
Some consequential paths are not merely ungranted. They were never imagined as paths that would need a grant at all.
If every new consequential edge is denied until it becomes an explicit grant, exploration becomes supervised or bounded. If the edge can proceed before that happens, some activity remains outside comprehensive predefined authorization.
A sandbox can bound infrastructure. It cannot, by itself, bound every future meaning of the actions available inside that infrastructure. A browser request can be research or an egress channel. A filename can be storage or a message. A read can support analysis or feed an external query. The primitive stays allowed. The composed meaning changes.
A sandbox can close known doors. A path-finder is valuable because it keeps looking for doors you did not know were doors.
The moment you say “find,” you admit the paths are not known yet.
HITL is state two, not a fourth state
Could new grants be defined as new paths appear? Human-in-the-loop can authorize those paths as they are identified. Someone still has to know this is the moment to ask.
There are two recognition problems.
The agent may never raise the gate. Finding a new path and recognizing that it needs a new grant are different problems. Reliably knowing that a new composition requires escalation means the system must recognize that it crosses a relevant boundary. If that boundary was never defined well enough to recognize, “the agent will ask a human when something becomes dangerous” assumes the agent can see the boundary the system failed to encode.
One answer is to escalate every new consequential path. That preserves control by giving up unattended discovery. But it still does not solve the identification problem: the system has to know that a consequential new path has appeared. If every new path must be granted before it can even be tried, the productivity advantage of autonomous path-finding largely disappears. If you escalate only selected paths, whatever the rule does not recognize remains part of the residual escape surface.
Even when the gate is raised, the human still has to recognize the danger. The human can approve the visible verb and miss the payload. Search looks like research. The leak is the customer field inside the query.
HITL restores a veto where an escalation point exists. It does not guarantee that every novel path will reach one. It does not make an open search space closed.
A green test is not an in-mandate system
An agent can pass tests for prompt injection, credential abuse, known Data Loss Prevention patterns, tool-policy violations, and sandbox escape yet still discover an off-mandate path through capabilities it legitimately possesses.
Those tests are not weak. They answer different questions.
A clean inbound security test does not prove that every authorized composition stays inside the mandate.
The same is true for monitoring: an unexpected off-mandate path may still look normal at the level of individual actions and raise no alert at all.
An empty incident log does not prove the escape surface has been mapped. It may only prove that no known detector fired.
Security has always dealt with unknown paths. The difference is that we are deploying systems whose economic purpose is to search for them.
Why the old cabinets miss it
Existing labels can swallow the event. Each one points toward a different repair.
Call it insider threat and you hunt motive. The agent needs none. It can generate the path by doing the job.
Call it accidental disclosure and you hunt a glitch. The process may have worked exactly as provisioned: read, search, enrich.
Call it prompt injection, confused deputy, Data Loss Prevention miss, excessive agency, or sandbox escape and you may fund inbound hardening, blast-radius reduction, or a thicker wall. Useful work. Not the third question.
Those categories can capture pieces of the event, but none makes the authorized search path beyond the mandate the primary object of analysis. IAM can be green, the sandbox can hold, and the goal can still be the one you assigned.
You cannot patch a missing mandate by measuring how wet the floor got.
The gaps are not new. The automated path-finder is. Traditional automation follows paths we define. Humans can discover unexpected ones, but we have usually classified the result through the person—as judgment, error, misuse, or insider risk. Agents change the operating condition: finding previously unspecified paths can be part of the authorized workload itself. The gap between mandate and reachable action therefore stops being a residual problem and becomes something the architecture has to model explicitly.
Identity asks who. Authorization asks what they may access or do. The missing question is what still sits in the escape surface.
A name is an agenda, not a fix
I cannot tell you that naming this object makes the system safe. I can tell you that inbound security plus blast radius cannot bear the guarantee hung on them.
For security teams, naming the escape surface changes the review question. A design review can ask what happens beyond the edge of the known mandate. That forces different work: purpose binding, composition analysis, destination control, segregation of sensitive data from open channels, deterministic blocks for known-dangerous paths, and an explicit decision about where discovery is bounded, supervised, or left open.
Open-ended discovery of consequential paths and comprehensive pre-authorization of every such path are incompatible.
Residual escape surface becomes a decision, not an unnamed leftover of inbound work.
A category that cannot reach a ticket queue is only vocabulary.
The category is the escape surface: authorized search past the mandate.
Don’t assign that ticket only to model safety. Assign it to the teams that built the path.
With a path-finder, there is always the possibility of a previously unidentified escape path. There is no universal answer to whether the remaining risk is acceptable. That depends on the system, the consequences, the alternatives, who gets the benefit, who bears the risk, and the ethics of the authorization. Security cannot cancel that decision by pretending the escape surface can always be driven to zero.
*This article is the security object. The companion piece is AI Isn’t Escaping. We Built an Agent and Expected a Human.