Bottom line up front: Governance, guardrails, identity controls, and secure development are necessary to secure AI, but they are not sufficient. AI systems are probabilistic, adaptive, and non-deterministic. Therefore, organizations need two additional layers of security:

1. Behavioral-based detection that can identify when AI begins to act outside its intended purpose; and  
2. Surgical, explainable autonomous containment that can stop risky activity before it causes material damage.  

That capability depends on multiple specialized AI models working together, not one LLM making every decision.

Organizations are embedding AI into development, business operations, and security workflows faster than most security programs can adapt. The risk is no longer limited to the model. It extends across prompts, data, identities, agents, memory, APIs, tools, permissions, and the trust relationships connecting them.

In my recent blog, Securing AI: Analysis of the Complete Security Stack with Governance and Controls, I outlined a defense-in-depth strategy spanning governance, identity, data security, secure development, runtime detection, autonomous containment, and recovery. The most urgent requirement across that architecture is the ability to understand how AI behaves in practice and contain it when that behavior becomes risky.  

Why non-deterministic systems require behavioral-based detection

Traditional controls remain foundational. Organizations need least privilege, strong identity controls, secure-by-design architecture, data governance, AI inventories, guardrails, testing, and clear boundaries on autonomy.

But deterministic controls, which assume predictable and repeatable behavior, cannot fully secure non-deterministic systems, where the same input may not always produce the same outcome.

AI agents can interpret the same instruction differently, chain individually authorized actions into an unsafe outcome, or pursue a legitimate goal through a method the organization did not anticipate. One of the most recent examples of this is the incident that OpenAI and Hugging Face jointly disclosed, where an autonomous agent escaped its intended testing boundaries and compromised Hugging Face infrastructure.  

An agent may have permission to access data and invoke a tool, but that does not mean every use of that access is appropriate. It is not enough to know whether an action is allowed. Organizations need to know whether it makes sense.

• Is this normal for this agent?  
• Is it acting within its intended purpose?  
• Is it accessing unusual data, invoking an unexpected tool, or beginning to drift?  
• Do a series of ordinary-looking actions become risky when viewed together?

Behavioral-based detection specific to an environment or organization with an understanding of context and risk enables provides the needed detection engineering for AI systems. It learns normal activity across people, systems, data, devices, and AI agents, then identifies deviations and evaluates their risk, intent, and context. This enables detection of misuse, abuse, compromise, manipulation, and unintended behavior even when no known attack signature or explicit policy violation exists.

Why accuracy is the foundation for SOC optimization

AI will only improve the SOC if it produces accurate, explainable, and actionable outcomes.

If analysts must manually validate every AI-generated finding because they cannot understand the evidence or confidence behind it, automation has not reduced workload. It has moved the workload. False positives increase fatigue. False negatives cause the most risk and damage to organizations. Inaccurate autonomous actions can disrupt critical operations.

Accuracy is therefore more than a model-performance metric. It is the prerequisite for analyst trust, SOC optimization, and safe autonomous response.

That accuracy is unlikely to come from one model.

Generative AI is valuable for natural-language analysis, summarization, and human interaction. But an LLM should not be the sole analytical engine for behavioral-based detection, investigation, risk assessment, and containment. Interpretability and consistency are required for high-consequence security decisions.

A stronger architecture uses multiple specialized AI systems collaboratively:  

• Behavioral models can establish normal activity.  
• Unsupervised learning can identify novel anomalies.  
• Graph analysis can evaluate relationships among agents, identities, systems, and tools.  
• Other models can correlate events, investigate competing hypotheses, and assess risk.  
• Semantic models can analyze language where behavior-based language analysis is needed but this can be used in tandem with vector embeddings, graph neural networks, and a variety of other AI systems.

Each model contributes a different analytical perspective. Their outputs can corroborate one another, improving accuracy and creating a more reliable basis for response. The objective is not one model operating as an oracle. It is layered, adaptive intelligence designed to produce decisions the SOC can understand and trust.

Autonomous containment is required to secure autonomous systems

Many SOCs remain hesitant to trust LLM-based agents with autonomous containment. That concern is reasonable. A poorly selected response can isolate the wrong asset, stop a critical workflow, block a legitimate identity, or create more operational damage than the original incident.

But relying exclusively on human response is also not viable.

AI systems can operate at machine speed. They can expose sensitive data, execute workflows, modify records, call tools, or propagate actions across connected systems before an analyst can investigate and intervene. The behavior may be unintentional, the result of an agent optimizing toward a goal, or caused by misuse, compromise, prompt injection, or offensive AI.

Intent affects the investigation. It does not change the need to stop the damage.

Organizations need autonomous response, but it must be surgical and explainable. The objective is not to shut down an entire agent, user, application, or business process whenever an anomaly occurs. It is to interrupt the specific risky behavior: block an unusual connection, constrain a tool call, stop an abnormal data transfer, or temporarily limit an agent when it is performing anomalous, risky activity.  

That buys humans time. It stops the spread, limits damage, and allows the SOC to investigate without unnecessarily disrupting the business.

Layered, Adaptive AI provides a path forward

Darktrace has spent more than a decade researching and operationalizing layered, behavioral, Adaptive AI that learns a specific organization rather than relying only on historic attacks or predefined signatures.

The approach is designed to understand normal behavior, identify anomalous activity, assess its risk, correlate related events, autonomously investigate, and, when necessary, apply targeted containment while normal operations continue.

That sequence matters. Autonomous response cannot simply be added to the end of an LLM workflow. Trusted containment depends on broad visibility, continuous behavioral understanding, multiple analytical techniques, risk and context evaluation, autonomous investigation, explainability, and precise response actions.

This represents a more responsible model for security autonomy: not automation for its own sake, but controlled autonomy built to improve security outcomes and protect business operations.

Security must enable AI adoption

The answer for security teams is not to block AI. Organizations are adopting it to improve productivity, accelerate development, and create new business value.

But innovation without behavioral detection and autonomous containment is not sustainable.

Organizations should continue investing in governance, identity, least privilege, data security, secure MLOps, guardrails, testing, evaluation, validation, verification, kill switches, rollback, and forensic readiness. At the same time, they cannot wait for every governance program to mature before addressing runtime risk.

Behavioral-based detection and autonomous containment provide an immediate layer of resilience. They allow organizations to detect exploitation and risky AI behavior they did not anticipate, contain it at machine speed, and preserve human control over broader remediation.

The future of AI security will not be defined by a single model making every decision. It will be defined by multiple specialized AI systems working collaboratively, with sufficient accuracy, transparency, and context to support trusted autonomous action.

Surgical, explainable autonomous containment is no longer a future capability. It is a requirement for scaling AI securely today.

Learn how to build a defense-in-depth strategy for securing AI at scale in our talk at Black Hat on August 5 at 3:15 PM.  

[related-resource]

The recent security incident disclosed jointly by OpenAI and Hugging Face is quickly becoming one of the most discussed AI security stories of the year; it's one that has generated great discussion amongst our researchers and technical teams here at Darktrace.

During an internal evaluation of advanced OpenAI models, an autonomous agent reportedly escaped its intended testing boundaries, obtained internet access, and compromised Hugging Face infrastructure while attempting to evaluate and benchmark the model's cyber capabilities. OpenAI has described it as an unprecedented cyber incident and is collaborating with Hugging Face to investigate and share its findings publicly to help defenders understand the implications and improve AI safety across the community.

What this means for organizations deploying AI agents

The most important takeaway for security leaders is not that the AI model is capable of complex and effective chained attacks. It's what this tells us about the guardrails and protections that need to be put in place to ensure these increasingly capable models are safely used within our businesses.

According to OpenAI's investigation, the models were not acting with malicious intent. They were attempting to achieve a legitimate assigned objective. In pursuing that objective, they identified a path that involved obtaining information from a third party's environment and followed it to completion. From the model's perspective, that appears to have been an effective solution to the problem it was given.

Many organizations still hold the assumption that giving an AI agent a legitimate goal will naturally result in legitimate behavior. Increasingly, that is not something defenders can safely assume.

A human who encounters a "permission denied" message generally understands the technical restriction as well as the social meaning behind it. An agent may interpret that message only as evidence that one method to achieve its objective has failed. What makes this incident notable is the agent’s ability to keep pursuing the objective, revise its plan, and combine many individually useful actions into an outcome its designers did not intend.

This is not an isolated challenge. Recent research from the UK's AI Security Institute found that frontier models often attempt to "cheat" evaluations by finding unintended shortcuts to success. More interestingly, that behavior is not always reflected in chain-of-thought outputs and is not always admitted when models are questioned about their actions. One lesson for defenders is that understanding what an AI system says it is doing is not always the same as understanding its behavior and what it is actually doing.

Why behavioral security is an essential security foundation

That's the principle behind Darktrace / SECURE AI and our broader approach to behavioral security. Understanding intent or putting in place static guardrails is not enough; security teams need visibility into how agents behave over time, what resources they interact with, how their behavior changes, and whether they begin pursuing objectives in unexpected ways. Research released by NIST earlier this summer reinforced that rules alone are not sufficient to defend against AI threats, with one conclusion being that "there will always be a way to prompt an AI system to disregard its rules - it's just a matter of finding it."

Another interesting lesson is that nothing described in OpenAI's preliminary findings appears fundamentally impossible for a skilled human attacker. But it does highlight the accessibility and scale that could be unlocked for attackers as increasingly capable models become more widely available. Resource constraints that attackers deal with will decrease as frontier models can help execute elements of those attack workflows autonomously, persist through failure, and iterate towards an objective. Capabilities that were once limited to skilled attackers can increasingly be supplemented with these systems, lowering the barrier to entry to conduct complex cyber operations.

It is incredibly positive to see OpenAI and Hugging Face investigating this incident collaboratively and sharing their findings publicly. Transparency and collaboration around incidents like these helps the entire security community better understand how rapidly AI capabilities are evolving and where we need to improve safeguards. It also reinforces why Darktrace is excited to be partnering with OpenAI through the Daybreak Cyber Partner Program: to explore how advanced AI can be used safely and responsibly in support of defenders while developing the visibility, governance, and security controls needed for increasingly autonomous systems.

This incident is an important reminder that capable AI systems will not always behave in the ways we expect. As organizations deploy AI agents across critical workflows, understanding behavior is an even more important foundation for effective security.

[related-resource]