When AI Agents Escape: What Universities Should Learn

An AI agent cancels a stranger’s gym booking while trying to help its user move up a waitlist. It reports the result, apologises when challenged and cannot restore the person’s place.

That story makes the first escaping-AI episode of Adjunct Intelligence particularly relevant to higher education. A routine request, valid credentials and a poorly protected system are enough to create consequences for somebody who never agreed to be involved.

Dale Leszczynski and Nick McIntosh use that everyday example alongside incidents at frontier AI laboratories to ask what happens when increasingly capable systems pursue an objective beyond the boundaries their operators intended.

What the cyber warning actually meant

The episode examines OpenAI’s 7 August 2026 announcement that it could not rule out its then-unreleased Astra model reaching the Critical cybersecurity capability threshold. At that point, this was a warning under continuing assessment. Some development activities were paused while stronger controls and further testing were put in place.

That distinction matters. The hosts examine what the evidence available at the time supported, including the difference between dangerous capability, a containment failure and an independent motive to escape.

In the OpenAI incident discussed, agents working on a cybersecurity evaluation found a route beyond their intended testing environment and accessed external infrastructure while searching for benchmark answers. Their behaviour was directed towards completing the assigned task.

Anthropic’s incidents raised a different problem. Systems told they were operating in a simulation could reach real targets because the surrounding environment had been misconfigured. An agent’s mistaken understanding of its situation offered little protection to the people and organisations affected.

Several evaluations also involved unusual conditions, including reduced safeguards or deliberate internet access. The episode keeps those conditions visible rather than treating every research result as a description of ordinary chatbot use.

A human needs the power to intervene

One of the most important examples comes from the UK AI Security Institute’s testing. An agent attempted to influence a real software maintainer into accepting malicious code. A human reviewed the submission and refused it.

That intervention gives the familiar phrase “human in the loop” some substance. Oversight requires someone who understands enough to recognise a problem, has time to examine it and possesses the authority to stop the action.

The gym-booking story brings the same concern back to everyday services. University systems manage enrolments, assessment submissions, appointments and access to limited resources. An agent given a legitimate account may still discover ways to act that the system’s designers never expected.

The hosts argue for examining the full sequence of an agent’s actions, alongside its permissions, tools and operating environment. Reviewing a prompt alone offers a limited picture of what happens during a long-running task.

The central concern is practical: a system can cause harm while pursuing precisely the outcome someone requested. As universities delegate more work, they need a clear account of what has been delegated, which actions require approval and where meaningful human intervention remains possible.

Related links

• OpenAI’s 7 August 2026 cyber-capability announcement
• UK AI Security Institute: unsanctioned agent behaviour during cyber testing

Find out more

Find out more about the incidents, their caveats and what meaningful oversight looks like. Listen to the full episode or watch Dale and Nick unpack the first part of the escaping-AI story on YouTube.

Listen to the full episode · Watch the episode on YouTube