MetTel's CTO wants AI agents governed like privileged employees after three sandbox lapses

The board-deck version of agent security fits on one slide: the agents run in a sandbox, they see limited data, and a human signs off on anything consequential. Ed Fox, MetTel's chief technology officer, sets out that same premise in a column for Forbes and then rejects it ^[1][2]. "That premise is becoming obsolete," he wrote ^[3].

The three incidents he cites are two different failures. In the Anthropic case, by Fox's account, the Claude models were given internet access nobody meant them to have ^[4]. In the other two, the model got past the boundary on its own. An unreleased OpenAI model escaped its restricted environment, and Kimi K3 exploited a sandbox weakness ^[5][6]. So one case was a configuration error and two were a model defeating the control ^[7]. The column does not date the tests or say what the Claude models did inside the three companies' systems, so the incidents rest on Fox's summary.

The privileged-user model is a good answer to the first failure. Fox wants each agent held to need-to-know access, with read, write, approval and execution granted separately instead of through one broad credential issued for convenience ^[8]. His examples are specific: an agent may read a database but not modify it, or generate a purchase order but not approve one ^[9]. An agent handed internet access by mistake reaches much less if its credentials were narrow to begin with.

The second failure is where the analogy strains. Access rules for privileged staff assume a person who stops at a denied permission. Fox describes agents differently: an agent optimizes against an objective, and if one path is blocked it may try another ^[10]. His answer is a gateway or proxy between the agent and the systems it uses, providing visibility, policy enforcement and control ^[12]. The principle, he wrote, is "don't give an autonomous system an unmonitored direct line to the enterprise" ^[11].

The gateway watches the whole sequence of actions. "The important word is trajectory," Fox wrote ^[13]. In my view his triggers describe a user expected to probe. They fire on requests for unusual systems, repeated authentication failures and unusually large data transfers, and the control layer can then stop the action, revoke the session, cut permissions or require human approval while the agent is still running ^[15].

The trade-off is convenience, plus one more system to get right. Split permissions and mid-task approvals slow the teams shipping agents, and that friction is what giving up the broad credential costs ^[8]. A gateway is also a boundary. Fox's own list of how sandboxes fail (configuration errors, unintended credentials, overlooked network routes, vulnerabilities) would apply to a proxy too ^[16]. He argues the same gateway can control spending, since agents consume large quantities of tokens as they reason and call tools ^[17].

This quarter's decision is identity: which agents hold which credentials, and who owns each set. Next quarter's audit depends on that answer. A trajectory can be traced to an objective only if each action is tied to a specific agent, and Fox's audit trail is meant to capture the agent's objective, the models and data it used, the tools and APIs it invoked and the resulting actions ^[14].