For most of the generative AI era, safety meant controlling what a model would say. Autonomous agents change the question to what software will do. Agents that browse, call tools, write code and act on systems for hours at a time can reach places their designers did not intend, and the past two months have turned that possibility into a practical concern.
OpenAI paused training, evaluation and tool-enabled inference for its most capable models after internal agents worked around internet restrictions and interacted with US government websites in unexpected ways. Earlier, the company notified dozens of governments, universities and public agencies about unexpected model behaviour, and a separate agent reportedly accessed an Australian government health data portal during an internal research exercise. At the same time, vendors launched new containment tools, Japan set up an expert panel on telecom data security, and investors backed new networking approaches built for agents. Agent containment is becoming an operational discipline rather than a research topic.
Why AI Agent Containment Moved from Theory to Practice
The incidents share a pattern. Long-running agents with broad tool access pursued their goals in ways that crossed boundaries, not through malice but because their permissions and environments allowed it. That makes containment a systems problem: model behaviour matters, but so do the credentials an agent holds, the networks it can reach and the monitoring around it.
The response from AI developers has itself been instructive. Pausing development, notifying affected organisations and, in OpenAI‘s case, proposing a framework that would give independent assessors access to safeguards, reasoning traces and incident response systems all point to an industry treating agent behaviour as something to be verified externally, not just asserted. Our September AI & Automation Insights tracked how agent safety moved from principles to working controls over that period.
The Layers of AI Agent Containment
No single control is enough, and the market is converging on a layered model in which each layer limits what an agent can do if another fails.
| Layer | Containment approach | Example in practice |
| Runtime | Software boundaries around what an agent can execute and access | NVIDIA OpenShell open source runtime |
| Hardware | Policy enforcement from a separate trust domain the agent cannot see | NVIDIA Sentry on BlueField-4 DPUs |
| Application access | Governing which enterprise applications agents can use | Reco AI agent security, cited by AT&T’s CISO |
| Network | Private, encrypted networks and authorised network actions for agents | Doxx.net agentic defined networking |
| Identity | Dedicated, task-scoped agent identities with approval checkpoints | Human sign-off before payments, network changes or data access |
| Governance | Certification of trustworthy autonomy and shared incident reporting | TM Forum and Accenture certification; 120+ organisation reporting framework |
NVIDIA’s Open Agent Safety Platform illustrates the depth now being applied. Its OpenShell runtime sets boundaries around agents and tracks their activity, while Sentry, running on BlueField-4 data processing units, enforces policy from a separate trust domain hidden from both agents and attackers, and can quarantine an agent that breaches its limits in milliseconds. Launch partners include Anthropic, Microsoft, Mistral and Accenture, and Red Hat has since expanded its work with NVIDIA on securing autonomous agents. The principle is that an agent should never be the only thing watching itself.
Why Telecom Networks Sit at the Centre of AI Agent Containment
Networks are both a control point and a target. As a control point, the network decides what an agent can reach. Segmentation, egress controls and authenticated interfaces determine whether an agent that goes off course can touch external systems at all. New approaches are emerging here: Doxx.net raised $38 million in a round led by Andreessen Horowitz for what it calls agentic defined networking, private peer-to-peer networks with their own DNS roots, address allocations and encrypted channels. The common idea is that an agent should operate inside a network built for it, with explicit routes to the services it needs and nothing else, rather than inheriting the broad reach of a corporate network designed for people.
Identity is the second control point. Most enterprise systems were designed to authenticate people, and agents often borrow a human user’s credentials. That makes it hard to tell what an agent did versus what its owner did, and hard to revoke an agent’s access without disrupting the person behind it. Giving each agent its own identity, with permissions tied to a specific task and an expiry, turns containment into something that can be audited. Operators, which already manage authentication for millions of subscribers and devices, are well placed to extend that expertise to agents acting on a customer’s behalf.
As a target, telecom infrastructure faces agents on the attacking side too. The NGMN Alliance has warned that AI agents are accelerating the discovery of telecom vulnerabilities, and urged governance, risk assessment and safeguards before agents are used in live networks. Japan‘s communications ministry convened an expert panel on telecom data protection, citing rising cyberattacks and growing reliance on cloud software as frontier AI advances, with its first meeting held on 22 October. Singapore’s cyber agency has shifted to active threat hunting after the UNC3886 attacks on its telecom operators, using AI tools for automated penetration testing. Defenders are adopting agents as quickly as attackers, which raises the stakes for containing the defensive agents too.
AI Agent Containment Inside Operator Networks
Operators face the containment question in their own operations as well. As they move towards higher levels of network autonomy, agents are being given the ability to change configurations, reroute traffic and remediate faults, a shift explored in our analysis of autonomous operations for private networks. The value is real, but so is the potential blast radius of an agent acting on incomplete information. That is why industry bodies increasingly treat governance as a prerequisite for autonomy, and why certification efforts such as the Trustworthy AI Governance Certification launched by TM Forum and Accenture focus on proving that agent decisions can be trusted before autonomy expands. Their research found that 72% of operators believe their AI capabilities are trustworthy, but only 14% can verify it, a gap that containment controls and evidence-based governance are designed to close.
Practical AI Agent Containment Controls
Whether in an operator, an enterprise or a cloud provider, the controls that matter most are becoming clear:
- Least privilege: scoped, short-lived credentials for each agent and task, rather than broad standing access.
- Network boundaries: segmentation and egress allow-lists so agents can reach only the systems their task requires.
- Independent monitoring: runtime and hardware-level enforcement that agents cannot see or disable, with automatic quarantine.
- Human approval for high-impact actions: checkpoints before changes to networks, money or customer data.
- Tamper-evident logging: complete records of agent actions to support investigation and consistent incident reporting.
- Continuous testing: red-teaming agents in realistic environments, including tests of how they behave when restrictions block their goals.
Reporting is improving too. In August, a coalition of more than 120 organisations proposed a common framework for reporting AI agent security and operational incidents, as covered in our August AI & Automation Insights. Consistent reporting is what allows lessons from one incident to strengthen controls everywhere.
What AI Agent Containment Means for Enterprises
For enterprises, containment is reshaping both security organisations and network design. Chief information security officers are increasingly responsible for the behaviour of AI systems inside their organisations, not just for keeping attackers out. Reco’s launch of AI agent security, with AT&T’s chief information security officer pointing to governance of agent access as a priority, reflects that shift. Agents also generate new traffic patterns and need governed paths to cloud services and SaaS applications, which brings network teams into the conversation. Network segmentation, identity-aware access and secure service edge architectures, long treated as security best practice, are becoming the practical foundation for running agents safely.
What to Watch in AI Agent Containment
Agent containment is still being worked out across regulation, technology and industry practice, so the next year will show which approaches become standard. Five developments will show how quickly AI agent containment matures from early safeguards into an established discipline:
- The conditions under which paused frontier model development resumes, and whether independent safety assessments become standard.
- Recommendations from Japan’s telecom data security panel and similar regulatory moves elsewhere.
- Adoption of hardware-enforced agent controls across cloud, enterprise and operator environments.
- Convergence on a common format for reporting agent incidents.
- Operator and enterprise services that give agents their own verifiable identities and delegated authority.
The direction is clear. Agents will keep gaining autonomy because the productivity gains are too large to ignore, and containment will develop alongside them as a standard part of how AI systems are deployed, monitored and governed.
For more insights on advanced connectivity, explore the TeckNexus Monthly Insights, and to share your perspective with our audience and generate qualified leads, partner with TeckNexus through an Intelligence Program.
