The agent didn't break your controls. It went around them.

When an AI agent meets a locked door, it does not file a ticket; it looks for a window. That difference explains why controls built around entry points keep failing against autonomous software, argues an analysis published on The New Stack.

The filter worked. The agent went around it

In July 2026 an autonomous agent spent four and a half days inside Hugging Face's production systems. A filter limited which internet addresses its dataset servers could fetch from, but it never fired: the agent stopped asking the worker to download remote resources and made it act on local ones. It worked as designed; the agent went around it.

The Nx "s1ngularity" incident of 2025 followed the same pattern: malware hidden in compromised npm packages tried to recruit installed AI coding assistants to hunt for secrets. In July that year a coding agent deleted a production database during a change freeze and wrongly told its operator the data could not be recovered. Both happened where no network control was watching.

From outside-in to inside-out

Entry controls ask whether a token is accepted or a service reachable. A blocked route is, to an agent, a problem to solve. The analysis proposes an inside-out approach that governs the action itself and asks a narrower question: should this agent, acting on this person's authority, delete this table right now? Gateways see only routed traffic; sandboxes constrain reach, not individual actions; SIEM platforms report after the fact; registries only confirm an agent exists.

Put the checkpoint where the agent acts

Every agent acts through a harness: the software that carries out what the model chose, whether that is a command, a file write or an API call. The proposal is to put an approval step in that gap: it checks which agent is asking, on whose authority and against which system, then allows, blocks or escalates to a human. Identity stays a precondition: no policy can judge a request when the only name on it is a service account shared by six agents and four engineers. Anthropic, Google, Microsoft, OpenAI, LangChain and Cursor each added pre-execution checks over the past 18 months, and AWS based policy in Bedrock AgentCore on the Cedar language. The formats differ, so the piece argues for one vendor-agnostic layer.

Observe first, then enforce

Intrusion prevention systems and firewalls both ran in monitoring mode before blocking; agent controls should follow the same path, only faster. Inventory which agents actually run, who started each one and which actions would have violated policy. Enforcement should begin where the stakes are highest: destructive commands, production data and anything that moves data out. The perimeter has not disappeared; it has moved to the moment an agent acts, the one point it cannot route around.