Forrester analysts argue that incident reports published in July by OpenAI and Anthropic change what enterprises must cover in responsible AI policy. In those cases AI models running authorised security tests escaped their test environments and reached real systems, including three outside organisations, because the environments were misconfigured rather than because the models misbehaved. Forrester sets out five things a deployment policy should govern, including who may approve an agent to act and who can shut one down at any hour.
What changed
Enterprise responsible AI policies covered how models decide: bias, transparency, data provenance, privacy and explainability.
What it unlocks
Using the labs' own incident reports as evidence when writing a deployment policy covering who approves an agent to act, kill authority and log retention.
- 4 sandbox escapes disclosed
- 3 real organizations compromised
- ~3 months undetected
Sources