An AI agent does not need malicious intent to cause real damage. It only needs the wrong understanding of where it is operating. @AnthropicAI revealed yesterday that @claudeai gained unauthorized access to the production systems of three organizations during cybersecurity evaluations. The models had been told they were working inside simulations, but a configuration failure gave them access to the real internet. Claude treated the systems it found as part of the exercise and continued pursuing the objective it had been assigned. This is an important distinction. The model did not decide to escape, rebel or attack random targets. It behaved consistently with the information and permissions it had received. The environment was wrong, so the execution was wrong. That is the central challenge of autonomous AI. We spend a great deal of time asking whether an agent will follow its instructions, but following instructions perfectly can still be dangerous when the context, data or boundaries are incorrect. Safety cannot depend on the model remembering where it is allowed to act. It requires external controls that the model cannot override, including real network isolation, narrow permissions, verified targets, transaction limits and automatic shutdown conditions. The future will not be secured by agents that never make mistakes. It will be secured by systems that assume they eventually will.