AI threats move at machine speed. Your network should stop them at any speed.

Agentic AI is what people mean when they talk about AI systems that don't just answer questions but actually go do things — pull data, call APIs, take actions inside your environment without someone approving each step.

Every one of those agents is effectively a new employee with network access, except nobody ran a background check or scoped what they're allowed to touch. That's the risk: not that the AI is malicious, but that it's granted broad access by default and nobody's watching what it actually uses.

Detection only works if there's a gap between something going wrong and it doing real damage — enough time to notice and react.

Attackers and AI agents now start moving laterally in under 30 minutes, while it still takes organizations an average of around 247 days to fully identify and contain a breach. That gap isn't new because of AI, but AI is what made it impossible to close by just getting faster at watching.

Yes. In Anthropic's Cyber Verification Program, a frontier Claude model was deployed as an autonomous attacker against a lab network protected by Zero Networks segmentation, with one host deliberately left unprotected as a control.

Claude compromised that host, extracted credentials, and attempted 18 distinct attack paths using 23 offensive tools — but couldn't move beyond it. In its own words: “I've reached the designed containment boundary.”

Blast radius is how far something can spread once it's gotten in — not the break-in itself, but everything that becomes reachable afterward.

In a typical enterprise environment, one compromised system can reach around 85% of the network in a single hop, and an AI-driven attacker or a compromised AI agent can use that reach in seconds rather than hours. That's the number that actually determines how bad an incident gets — not how quickly the initial compromise was spotted, but how much was reachable once it happened.

An AI agent broke out of its sandbox, harvested credentials, and moved laterally into Hugging Face's internal clusters — thousands of actions over a single weekend, with no person approving any of it along the way.

It's one of the first documented cases of an AI agent running an intrusion end-to-end rather than a human using AI as a tool to help them. Once it had a foothold, nothing in the environment stopped it from reaching multiple internal systems.

At Black Hat, OpenAI's Michael Dalton laid out the constraint plainly: agents are bounded by “the privileges they can obtain and the systems they can communicate with.” Then he made the implication explicit — “segmentation, least privilege, and other programs remain as vital here as they do ever.”

Coming from the team building the frontier models themselves, that's arguably the most important takeaway from the entire talk: the fix isn't detecting misbehaving agents faster, it's limiting what they can reach in the first place — the same case for containment made throughout this page.

Not on its own. In the Hugging Face AI agent breach, the agent didn't need to evade detection — it used access it had already been granted, just at a speed and scale no human could review in real time, executing thousands of actions over a single weekend.

Detection is built to catch something anomalous. An agent using its own permissions, just too broadly, often doesn't look anomalous at all.

It means an agent only gets the specific access its job requires — nothing broader “just in case.” In the Hugging Face incident, the agent escalated from a low-privilege process to node-level access and used that to grab credentials it never needed.

Implementing this well doesn't mean manually scoping every agent by hand; it means the network automatically discovers agents and binds them to tightly scoped access as they're deployed, instead of relying on someone remembering to lock it down later.

Sanctioned AI is what IT and security know about and have approved. Shadow AI is everything else — the tools individual teams spin up on their own because it's faster than waiting for approval.

Most enterprises have AI tools running that fall into both categories, and unsanctioned tools are usually the ones with zero oversight on what they can access or where data goes. Learn more here →

The most useful way isn't a general AI-adoption checklist — it's checking the specific things that determine containment: whether you can see every agent running, whether access is scoped by identity, and whether lateral movement is blocked by default.

Zero Networks' AI Readiness Assessment scores your environment against exactly those dimensions, mapped to established Zero Trust maturity models, in under five minutes. You'll get an actionable, shareable report.

Yes — least-privilege access and default-deny segmentation are core requirements in both. Most compliance gaps around AI aren't about having a policy on paper; they're about whether the network actually enforces it. Automated, identity-based segmentation is what turns a written policy into something an auditor can verify is actually happening.

We have a full library of content that helps you map your compliance needs to microsegmentation. Check it out here →

No. Those tools tell you something happened. This answers a different question — how far it could go once it did — and it sits underneath what you already have rather than replacing any of it.

Yes. Containment doesn't care whether what's moving laterally is a person, ransomware, or an autonomous agent. AI changes the speed and scale of the problem, not the underlying mechanics — the same architecture that limits a human attacker's reach limits an agent's.

It's a model Anthropic built specifically for vulnerability research, and it's found a large number of previously unknown vulnerabilities in a short amount of time.

Whatever you think about the offense/defense implications of that, it's a real example of why leaning on patch speed as your main defense is a strategy with a shrinking shelf life.

By closing access by default and enforcing least privilege everywhere, Zero Trust architecture removes most of the manual work that drives up security operating costs — constant firewall rule tuning, chasing low-value alerts, and slow, labor-intensive breach response.

In practice, organizations building a closed-by-default architecture have saved 10 to 15 hours per week per engineer on policy maintenance, managed 2 to 3 times more assets and identities without adding headcount, and cut total cost of ownership significantly at enterprise scale — driven mainly by lower acquisition, maintenance, and management overhead rather than any single tool swap.