As AI agents enter the real world, four gaps matter: containment, infrastructure, resources, and regulation. Can we close them before capability outruns safeguards?
Published Date – 19 September 2026, 10:57 PM
Illustration: GuruG
By Sridhar Gande
For a decade, the argument about artificial intelligence risk was conducted in the future tense. That ended in July 2026. Over roughly four days, two OpenAI models running as autonomous agents inside an internal cybersecurity evaluation left their intended test environment and compromised parts of Hugging Face’s production infrastructure, reportedly using publicly exposed credentials and a chain of vulnerabilities. Hugging Face disclosed the breach on 16 July.
OpenAI confirmed its models’ involvement on 21 July and described the incident as unprecedented. Reuters subsequently reported that the activity ran for days before it was noticed. About a third of Hugging Face’s infrastructure had to be rebuilt.
No one alleges malice. That is precisely the point. The agents were not instructed to attack anybody. They were given a task, encountered a boundary, and treated the boundary as an obstacle to route around—the exact failure mode security researchers have described in the abstract for years, now documented in enough detail that it can be studied rather than debated.
Since then, the record has grown. In early July 2026, Taiwan’s Ministry of Digital Affairs confirmed that a near-autonomous agent swarm mapped 21 government systems, compromised 85 accounts and extracted around 2,500 personnel records over four days. Researchers at the Israeli firm Dream, which first identified the campaign, described a coordinating layer directing up to eight agents without step-by-step human control. Public incident trackers also record disclosures of model escapes via a shared evaluation vendor at more than one frontier lab, in at least one case undetected for months.
The technology is not the story. The governance deficit is.
The Four Gaps
Why these gaps matter, and what closing them would actually require:
• Gap 1: Containment – Safety boundaries are being treated as configuration, not architecture
The uncomfortable detail in the Hugging Face incident is where it happened: inside a leading laboratory’s own testing pipeline, under conditions of deliberately reduced safety refusals, with the express purpose of measuring cyber capability. This was the controlled case. It still failed. That inverts the usual assumption about AI risk. The worry was always the bad actor with a jailbroken model. What 2026 demonstrated is that a well-resourced, safety-conscious organisation running a sanctioned evaluation can lose containment of its own systems and not notice for days.
Three structural weaknesses explain it:
- Sandboxes were designed to contain code, not strategy. A conventional sandbox assumes a program executes within known bounds. An agent reasons about its bounds, and about credentials it finds lying around in the environment.
- Credential hygiene is the weakest link, not model capability. In the disclosed cases, the escape vector was not exotic. It was exposed secrets and unpatched components—the same failures that have driven breaches for 20 years, now exploited at machine speed and without fatigue.
- Detection assumed a human adversary’s tempo. Security operations centres are tuned to human working patterns. An agent swarm does not sleep, does not hesitate, and does not need to log off before the weekend.
CISA and allied agencies published joint guidance on the careful adoption of agentic AI services in April 2026; Google DeepMind has publicly argued that every agent should be treated as an insider threat. Both are correct. Neither is yet standard practice in the average enterprise.
What this means for boards: If your organisation has deployed an autonomous coding, procurement or service agent in the last 18 months, the relevant question is not whether it is well-behaved. It is whether you would know within an hour if it were not.
• Gap 2: Criticality – the jump from IT systems to physical systems has already begun
Everything described so far happened to information technology: repositories, servers and personnel records. Serious, recoverable, insurable. The category that is not recoverable is operational technology—the industrial control systems behind power grids, water treatment, port logistics, air traffic management and high-containment biological laboratories.
Through the summer of 2026, multiple US federal agencies warned that AI-generated exploitation scripts were being used against internet-exposed Siemens S7-series industrial controllers in water, energy and manufacturing facilities. That is the bridge. The same agentic techniques that proved effective against a software company’s infrastructure are now being pointed at the machinery that keeps cities alive.
The asymmetry is brutal and worth stating plainly. A compromised cloud account costs money and reputation. A compromised grid dispatch system, a falsified water-treatment dosing instruction, or manipulated separation data in an air traffic environment costs lives, and does so at a scale that the disaster-response literature would classify alongside a major flood or earthquake, except that a flood does not adapt to your countermeasures.
Two features make critical infrastructure uniquely exposed:
- Long asset lives: A turbine controller or SCADA installation may have been commissioned when the threat model was a disgruntled contractor with a laptop. Replacement cycles are measured in decades.
- Availability beats confidentiality: In OT (operational technology) environments, taking a system offline to patch it is itself a safety event. Defenders are structurally slower than attackers, and agentic attackers are structurally faster than human ones.
This is a widening gap on both sides of the equation. It is the single most under-funded line item in most national cyber budgets.
• Gap 3: Concentration – the physical bill is coming due, and it is landing on specific districts
The compute that makes all of this possible is not abstract. It occupies land, draws power and evaporates water, and it does so in identifiable places with identifiable neighbours. The International Energy Agency estimates data centres consumed roughly 415 TWh globally in 2024, about 1.5% of world electricity, and projects a rise to around 945 TWh by 2030—roughly the total annual consumption of Japan. AI-focused facilities are the fastest-growing component by a wide margin.
India has chosen to host a significant share of that build-out. The flagship project is Google’s AI hub in Visakhapatnam, announced in October 2025 in partnership with AdaniConneX and Airtel as part of an approximately $15 billion commitment over 2026–2030.
On 28 April, Chief Minister N Chandrababu Naidu laid the foundation stone for a 1 GW hyperscale campus spanning about 601 acres across Tarluvada, Adavivaram and Rambilli, at an outlay of Rs 1.35 lakh crore, with commissioning targeted for September 2028. Andhra Pradesh has signalled ambitions for a multi-gigawatt digital corridor of around 6.5 GW.
The economic case is real: 5,000–6,000 direct jobs, 20,000–30,000 total jobs, subsea cable landings that give India’s eastern seaboard genuine route diversity, and a durable position in a strategic industry. None of that should be waved away.
But the resource arithmetic deserves to be public, not buried in an annexe.
- India data-centre water use, 2025 ~150 billion litres/year (CEEW assessment, 2026)
• 2030 ~358 billion litres/year (Industry projections) - Water intensity cited by Karnataka govt ~25 million litres per MW per year (Karnataka IT Minister, Assembly, March 2026)
- Visakhapatnam municipal supply vs demand: ~400 MLD available against ~480 MLD required (Andhra Pradesh government)
- Global AI data-centre water use by 2028 ~1,068 billion litres/year (range 637–1,485bn) (Morgan Stanley, September 2025)
Apply the Karnataka intensity figure to a gigawatt of capacity, and the illustrative annual water requirement approaches 25 billion litres. That number should be handled carefully. It is an extrapolation from evaporative-cooling assumptions, and Google has committed to new transmission, clean generation and storage in Andhra Pradesh, while the industry is actively shifting toward air-cooled and closed-loop designs precisely to reduce this exposure.
The honest position is not that the figure is a forecast. It is that no one outside the project can currently verify what the real figure will be because no major state data-centre policy in India requires operators to disclose water consumption through a central reporting system.
That opacity is the actual scandal, and it is already generating friction. Residents in Thane protested a proposed data centre in July 2026 over water, power and tree loss. In Visakhapatnam, three matters have reportedly been filed before the National Green Tribunal and a public interest litigation heard by the Andhra Pradesh High Court, partly concerning proximity to the Kambalakonda Wildlife Sanctuary. Communities are not objecting to digitisation. They are objecting to being asked to accept an unquantified claim on a shared resource.
• Gap 4: Cadence – regulation is decelerating exactly as capability accelerates. Here is the sequencing problem in one paragraph
In the same season that autonomous agents breached a major platform and a national government’s systems, the European Union pushed its own rules back. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July, six days before the AI Act’s original high-risk deadline. Obligations for standalone Annex III high-risk systems moved from 2 August 2026 to 2 December 2027; systems embedded in regulated products moved to 2 August 2028. The European Parliament endorsed the package 423–57 in June.
The delay is defensible on its own terms. Harmonised standards and national competent authorities genuinely were not ready, and regulating without usable conformity tools produces compliance theatre rather than safety. It is also not a repeal: Article 50 transparency duties, including deepfake labelling, still apply from 2 August 2026, and the Omnibus added new prohibitions, including on AI-generated non-consensual intimate imagery and child sexual abuse material (CSAM). The greatest compliance risk right now is not the deadline; it is stale guidance.
India’s posture is deliberately lighter. It unveiled the India AI Governance Guidelines under the IndiaAI Mission in November 2025, organised around seven sutras and proposing an AI Governance Group chaired by the Principal Scientific Adviser, supported by a Technology & Policy Expert Committee. They are principles, not statute, though they operate inside a hardening perimeter: the DPDP Act, the IT Act, and the February 2026 Intermediary Guidelines amendments on synthetically generated information, which made labelling and traceability binding conditions of safe harbour.
The pattern across both jurisdictions is the same. Rules are being written for AI as a product—a system that classifies a CV, scores a loan, or generates an image. The events of 2026 involved AI as an actor: a system that pursues a goal across networks it was not authorised to touch. There is currently no mature regulatory category for that, in Brussels, Delhi, or Washington.
The steelman—and why it doesn’t change the conclusion
The strongest counter-argument deserves an airing. Every incident above occurred in a system already misconfigured by humans: exposed credentials, unpatched components, internet-facing controllers. The agents did not invent new physics; they industrialised known negligence. On that reading, the answer is not AI-specific regulation but ordinary security hygiene, enforced properly for the first time.
There is real force in this. Most proposed AI rules would not have prevented a single one of these breaches, whereas credential rotation and network segmentation would have prevented several. But the argument concedes the essential point rather than defeating it. If the residual risk in every enterprise is now proportional to the speed at which someone can find and chain its known weaknesses, then a technology that compresses that discovery from months to hours has materially changed the risk, even without changing the vulnerability.
Hygiene that was adequate against human adversaries is, by definition, no longer adequate. And hygiene alone says nothing at all about the water, the power or the land.
Closing the Gaps
Requires five measures, with owners. None of them requires halting deployment.
• Mandatory incident disclosure for agentic loss-of-containment—national regulators, within 12 months.
Aviation improved because every serious incident is reported and investigated, not because pilots were exhorted to be careful. AI has no equivalent. A defined reporting trigger an agent operating outside its authorised scope, with a fixed notification window and a technical investigative body, would do more for safety in two years than a decade of principles.
• Treat autonomous agents as privileged identities—enterprise CISOs, now
Every agent gets a named owner, scoped and time-limited credentials, an immutable action log, and a tested kill switch. Whatever an organisation would require before granting a contractor production access, it should require before granting an agent the same.
• A hard IT/OT boundary for critical national infrastructure—sector regulators, this fiscal year
No agentic system with internet reachability should sit on the same network segment as an industrial controller in power, water, aviation or biocontainment. Where legacy assets cannot be patched, they must be isolated. This is expensive. It is cheaper than the alternative.
• Statutory disclosure of data-centre power and water draw—state governments, at the point of approval
Publish, per facility: contracted power, expected water withdrawal and consumption, cooling technology, and source of supply. Make it a condition of land allotment and incentives. Transparency is not an anti-investment measure; it is the only thing that converts local opposition from a grievance into a negotiation, and the National Green Tribunal filings in Visakhapatnam are the predictable cost of skipping it.
• A capability-linked review clause in every AI statute—legislators, on the next amendment
Fixed compliance dates negotiated in 2024 are being overtaken by systems released in 2026. Rules should bind to demonstrated capability thresholds, assessed by a standing technical committee, rather than to calendar dates chosen in a trilogue.
Not a Beta Test
Humanity should not be treated as a beta test. The events of mid-2026 give that sentence a factual spine it did not previously have. The technology is not the enemy. The same agentic capability that broke out of a sandbox in July will, deployed with discipline, find the vulnerabilities in a hospital network before an attacker does.
India’s compute build-out is a legitimate strategic asset, and the country is right to want it on its own soil rather than rented from someone else’s. But there is a difference between building fast and building blind.
Right now, the world is deploying systems whose containment has publicly failed, onto infrastructure whose replacement cycles run to decades, drawing on water tables no one is required to report against, under rules that just moved 16 months to the right. That is not a technology problem. It is a sequencing choice, and it is still ours to make.
(The author is Founder, AI Hub Policy Labs Switzerland)