AI agents.
Beautifully
managed.

Yes, failures of technical isolation have been documented. OpenAI’s August 2026 investigation describes agents bypassing internet restrictions during cyber evaluations and reaching third-party systems. Those runs used reduced safeguards and were primarily driven by an internal research model. That context matters when comparing them with a business deployment.

A sandbox escape bypasses an enforced technical boundary. Other incidents involve a connection left open by mistake, or an agent misusing access it was deliberately given. Anthropic’s July disclosure describes unintended internet access. AISI’s August report describes deliberately enabled internet access and explicitly states there was no sandbox escape.

They demonstrate possible failures under specific conditions. Cyber evaluations can deliberately remove safeguards and give models unusually challenging, open-ended tasks. AISI cautions that its findings do not establish how likely this behaviour is outside testing. The useful business lesson is to examine the access and controls in your own deployment.

The consequences depend on what the agent can reach: sensitive information could be exposed, records changed or messages sent without the intended approval. Unnecessary tools and broad permissions increase that exposure. A read-only research workflow has a different risk profile from an agent that can modify live business systems.

Your agents run locally on a server dedicated to your organisation. Filigree sets up the agreed workflows and manages the agents over time. The server’s location, administration and connections should be specified in your deployment agreement, so “local” has a clear meaning for your business.

No. A dedicated server separates your agent runtime from other clients, but software flaws, excessive permissions and unsafe connections can still create risk. Isolation, network restrictions, credential handling and human oversight must work together. Local hosting alone cannot guarantee that an agent will never cross a boundary.

They are separate decisions. The agent’s runtime executes the workflow and uses tools. The model provides the AI responses. An agent can run on your dedicated server while calling a cloud model. Fully local inference requires a model and computing capacity hosted within the intended local environment; it must be an explicit deployment choice.

Yes, through configured connections. Requests to a cloud model provider, such as Anthropic, send that provider the included data. Connected business tools may also exchange information. Before deployment, the agreed design should identify destinations, permitted data and retention requirements. A local agent runtime does not by itself mean an offline or fully local data flow.

Prompt injection happens when an agent treats untrusted material as instructions. A document, email or web page can try to redirect the agent from its task. Running locally does not remove that exposure if the agent reads outside content. Separating untrusted content and limiting available actions helps reduce the impact.

An instruction guides behaviour; technical controls determine what is reachable. Model responses can be mistaken or manipulated. File permissions, network restrictions and tool authorisation need to enforce boundaries independently of the model’s willingness to follow a prompt.

Only what its agreed task requires. A summarisation agent may need read access to selected documents, while an operations agent may need a narrowly defined update action. Permissions should be enforced by the connected tools and systems. Broad administrator credentials and unused integrations increase the possible impact of a mistake.

Approval requirements should reflect the consequences. Payments, deletion, permission changes and sensitive external messages are examples to review before allowing autonomous action. For Filigree workflows, we agree where human review and escalation belong before the agent takes on the work.

The response plan should define who can stop execution, restrict affected access and investigate the activity. Relevant logs should be preserved, exposed credentials addressed and the cause reviewed before restarting. The practical stop controls, escalation contacts and response commitments need to be agreed for each deployment.

We monitor the work, review exceptions, maintain the agreed workflows and refine your agents as your needs change. Human review stays part of the design. The service scope, responsible people and support arrangements should be clear in your agreement.

Start with its job, server location, model choice and data flows. Then document the allowed tools and actions, approval steps, access owners, monitoring arrangements and incident response. Any requirements for retention, backups or security testing should be recorded and checked against the actual setup.

Yes. Start with a defined task, such as preparing a research brief or drafting an update for a person to review. Agree the required access, test real scenarios and assess the results before expanding the agent’s responsibilities. The first agent should fit the work and the level of oversight your team needs.