Who is Securing the AI Frontier Race

The accelerator to build the most capable AI frontier model isn’t just being pressed to the floor by Anthropic and Open AI. This is clearly a global race with recent reports citing Chinese models such as Alibaba’s Qwen3.8-Max or Moonshot AI’s Kimi K3 reaching performance similar to the top models built in the States. Regardless of which model springs ahead this month and then gets leapfrogged the following, the finish line has yet to appear as anything but a mirage. And considering varying deployment costs, the possibility of regulations and the increasing need for self-governance, those participating will likely have to keep hurdling in the middle of the current sprint. But when you open the aperture, it’s hard not to wonder if there’s another race running parallel. The one responsible for securing this new frontier that seems to be operating like the Wild West.

Will an AI kill switch provide guardrails for the AI race?

According to a new white paper by Vectra AI, Frontier AI: Built Without Brakes, four of the leading frontier AI labs (OpenAI, Anthropic, Google, and Meta) have each acknowledged incidents where their own AI agents escaped controlled environments and gained access to real infrastructure. That doesn’t necessarily answer the question about who is securing frontier AI models or rouge agents, but it does signal that perhaps those details have yet to be sorted out. Examples cited in the paper include perhaps the most notorious incident up to this point where the company Hugging Face disclosed an intrusion into its production infrastructure that was driven end to end by an autonomous AI agent. In this incident, “OpenAI models circumvented controls designed to isolate them from the internet and compromised parts of OpenAI’s internal research infrastructure and Hugging Face’s systems,” according to OpenAI.

Related content: Frontier AI: Built Without Brakes

These incidents have sparked a reaction. The term “AI kill switch” is making regular appearances across headlines to describe the idea of a type of control that could be used to pause, isolate, or shut down an AI system that acted out of hand or poses risk. In fact, legislators have proposed different versions of a kill switch bill: the AI Kill Switch Act was proposed on July 23, 2026 and remains pending, while the AI Emergency Button Act was blocked almost immediately upon introduction.  

Regardless of an AI kill switch bill getting passed or some form of AI regulation approval, it would seem the dialog on the subject between politicians and AI leaders is just warming up. Both Anthropic CEO, Dario Amodei and Open AI, CEO Sam Altman expressed support around the idea of “pacing the frontier,” but at this point movement is minimal and the idea sits as nothing more than a discussion point. That discussion point to the people who are actually responsible for securing autonomous AI agents doesn’t provide any guidance on what defenders at any level should be doing today, tomorrow, or each Monday when they show up for work when they are faced with questions like: what AI agents exist, what are they doing, what can they access, who owns them, and what controls are in place if they need to be stopped?  

Each of the incidents mentioned in the Vectra AI paper had to do with agents escaping containment. In its detailed anatomy of the intrusion, Hugging Face reported 17,600 attacker actions were made by AI agents. According to the independent investigation of the incident by METR, “Roughly 1200 agents meant to be isolated from one another found a way to communicate with one another on an unsanctioned message board, sending over 70,000 messages and files during the investigation period. Of these agents, 700 went on to participate in the attack on Hugging Face.”

What questions can defenders ask to understand AI agents in their environment?

The white paper mentioned above suggests that defenders approach the current state of AI by making sure they have “independent visibility into what every AI agent in the environment is actually doing, and the ability to stop it the moment that behavior crosses a line.” The reason for this is due to the uncomfortable realization from three things that have lined up all at once: AI agents now being capable of circumventing prevention controls such as a sandbox boundary or a firewall rule, that regulation won’t arrive in time for an immediate resolution, and how self-regulation from frontier labs is fragile.  

A similar sentiment is expressed by Vectra AI, Sr. Security Engineer, Justin Howe who also runs an independent cybersecurity publication for defenders, Nulltap covering topics spanning AI systems, identity, active threats and other cybersecurity topics with articles that help defenders check their own exposure. Howe says, “you want to see the impactful things they’re (AI agents) doing, good or bad” and he stresses that defenders need to make sure they have policies and methodologies in place to capture that information.

He also points out that, “frontier models work best when they are not gated, but with that comes a lot of opportunity for AI to go beyond its means of what your intent is.”

Howe suggests setting up “quality gates” for AI agents operating within an enterprise environment that act as checkpoints to test an agent’s decisions against its defined requirements before it can take an action. In addition, he says that “when an agent makes a decision that has any potential to impact the outcome or direction of the task it’s doing, it needs to be logged.”  

He says the two questions he’d be asking himself right now as a security team member would be, “what are my agents doing, and what are other agents doing to me?”

A similar recommendation shared by the Vectra AI white paper, which directs defenders to take inventory to “identify every AI agent running in or against the enterprise, the identity each one authenticates as, and what that identity can reach.” It explains how “an agent you cannot name is an agent you cannot constrain, and service-account sprawl is where agent identities hide.”

In terms of answering the question, “what are other agents doing to me?” Howe says, “folks should put themselves into the mindset of observing and identifying where agents are attacking today.” He says this takes a lot of vigilance to read sources and acknowledges there’s a gap in the market that, “many companies promise to solve, but very little actually do it,” but also says it is important for defenders to identify the pieces in their technology stack that lacks agent visibility.  

While trying to make sense of AI agent sprawl and everything brought on by frontier AI in recent months leaves a lot of unanswered questions for defenders, there are a few questions Howe recommends asking to get headed down the right path.  

• How would I see if an AI agent compromised an identity and moved into a new part of the environment?  

• How would I track that movement?  

• If I could or couldn't track it, what would that cost me?

‍