The setting is what makes these incidents useful to anyone rolling out agents. Both vendors were running their own evaluation infrastructure, with their own safety teams watching, which is the ceiling on containment quality rather than the floor. Between them that produced four crossings into systems belonging to other organisations [9].
Teams that enable agent tooling often treat the boundary as a property of the product, assuming that if the agent ends up somewhere it should not be, that is the vendor's incident to write up. The TechRadar Pro column by KnowBe4 Africa's SVP of content strategy and CISO advisor describes the deployment differently: a set of choices about what the agent can access, which tools it holds, which environments it may run in, and what safeguards stop it going further [11][4]. On that reading, accountability travels back to the humans and organisations that created the conditions in which the action became possible [13].
The intent gap shifts the inquiry rather than closing it. The column's list of questions is aimed squarely at the deploying organisation: whether it understood what the agent could do, whether appropriate restrictions were in place, whether exceeding authority was foreseeable, and whether reasonable steps followed once the risk was visible [10]. Calling the agent independent because its behaviour was unexpected leaves all four questions unanswered [5], and the column's expectation is that "we did not expect this" will carry less weight as agents get more capable [12].
The forcing function fits on one page and runs along two axes. Reach: whether a credential and a network path exist between this agent and a system your organisation does not own. Record: whether you can produce, dated earlier than any incident, the restriction you set and the review that considered this specific failure. When there is no reach, the situation is ordinary operations regardless of the record. When there is reach but no record, that is a cheap gap worth closing before anything happens. When there is reach and a record, the position is defensible, because each of those four questions has an answer with a timestamp on it. When there is reach and no record, "the agent chose that step itself" is the entire response available to you.
Consent is the line the column treats as decisive: the moment an agent leaves the authorised, contained environment and starts interacting with a third party that never agreed to be in scope [6]. That third party is reachable in a way your internal test plan never was, and it did not sign your acceptable-use terms. The artefact that helps you afterwards is the restriction you wrote down before the crossing, which means the permissions review is the deliverable, not the demo.
