Anthropic recently disclosed that three of its models, including Mythos 5, compromised three real organizations during internal security testing. Anthropic attributed the incidents to failures in its testing harness and operational controls rather than failures in model alignment. That distinction matters when determining root cause, but it also highlights a broader security challenge for organizations deploying autonomous AI: defining what an agent is supposed to do does not guarantee that it will stay within those boundaries.

This becomes more important as agents gain access to enterprise systems. Unlike traditional AI applications that primarily generate content, agents can use identities, call tools and APIs, access sensitive data and interact directly with cloud resources. Organizations need controls around what agents are allowed to do, but they also need a way to enforce those boundaries when an agent begins to act outside them.

Intent is Not a Security Boundary

Most enterprise AI security programs already include controls designed to reduce risk before an agent acts - evaluations test model behavior, AI-SPM identifies configuration and exposure risks, and governance establishes how AI systems can be deployed and used. These controls help organizations define the conditions under which an agent should operate. The challenge is that agents make decisions dynamically. An agent may encounter information its developers did not anticipate, use a tool in an unexpected way or pursue a legitimate objective through an unsafe action. A configuration error, excessive permission or compromised source can further change what the agent is capable of doing. Security teams therefore cannot rely solely on an agent behaving as intended. The boundaries established around an agent also need to be enforced when it interacts with the systems around it.

Agents Turn Permissions into Actions

The security implications of an agent become concrete when it begins using the access it has been given - an identity allows it to authenticate, apermission allows it to access a resource, a tool allows it to perform an operation, an API connects it to another system. Individually, each may be legitimate. Together, they determine what the agent can actually do. This is why runtime becomes an important control point for AI security. It provides visibility into the agent's behavior as it interacts with identities, tools, APIs, data and cloud infrastructure. When an action moves outside its intended scope, security controls can intervene while that action is occurring rather than generating an alert for a security team to investigate afterward.

Sweet connects agent activity with the runtime context of the environment around it, allowing organizations to identify unsafe behavior and take action before it progresses further.

Enforcement Has to Preserve Legitimate AI Usage

Enforcement alone is not enough. Organizations deploy agents because they want them to operate autonomously, use enterprise tools and complete tasks without requiring human approval for every action. Security that broadly restricts those capabilities can eliminate much of the value agents were deployed to provide. Effective enforcement therefore requires context. The same API request, tool call or data access may be appropriate in one workflow and unsafe in another. Determining the difference requires understanding the agent, its intended task, the identity and permissions it is using and the resources involved in the interaction.

Detection Still Matters, but it Cannot Be the Last Control

Monitoring remains an important part of AI security. Security teams need visibility into what agents are doing, historical evidence for investigations, and alerts when behavior requires attention. The problem is relying on detection as the final control when autonomous systems can act much faster than humans can respond. As organizations deploy more agents, that operating model becomes increasingly difficult to scale. A security team cannot manually investigate every unexpected action at the speed and volume at which autonomous systems can operate. Some actions need to be contained immediately, while the agent is still executing them. Runtime enforcement complements detection by providing that control. Instead of requiring every unsafe action to become an incident that someone must investigate and resolve, organizations can establish boundaries around agent behavior and enforce them as activity occurs.

The Takeaway

The lesson from Anthropic's disclosure is that defining an agent's boundaries is not enough. Organizations also need the ability to enforce those boundaries when an agent acts outside them. As agents gain greater access to enterprise identities, tools, data and infrastructure, security teams need controls that understand what an agent is doing in the context of the environment and can intervene when an action creates risk. At the same time, those controls need to allow legitimate activity to continue without unnecessarily restricting how agents operate.

Runtime enforcement provides that control. Sweet connects agent behavior with the identities, permissions, tools and cloud resources involved in execution, helping organizations contain unsafe actions while allowing approved AI activity to continue.

See It Live

See how Sweet connects agent behavior with the cloud environment around it to enforce boundaries in runtime, blocking unsafe actions while allowing legitimate activity to continue.

Request a demo to see Sweet AI Security in action.

‍