Designing Default-Deny Egress Controls and Inline Policy Inspection for AI Agents

Most of the effort spent making AI agents safe goes into persuasion.

Better system prompts, sharper refusals, longer lists of what the model must never do.

We are, in effect, raising the agent to have good judgment and hoping it keeps that judgment under pressure.

Here's the discovery that flipped how I think about this.

The two most active areas of AI security research in twenty twenty-six, red teaming and agent behavior studies, are both quietly proving the same thing.

Persuasion is not a boundary.

Once I saw the pattern in both literatures at once, the whole align it harder approach started to look like a category error.

Start with red teaming.

Government safety institutes and frontier labs have stopped handcrafting individual jailbreaks and started running automated multi-turn agent versus agent attacks at scale.

The picture that comes back is genuinely two-sided, and the tension between the two halves is the interesting part.

On one side, guardrails can be hardened more than the cynics claim.

Anthropic's constitutional classifiers work reported that across more than three thousand hours of human red teaming, no attacker found a universal jailbreak that pulled detailed harmful content out of a classifier-guarded model the way it could from an unguarded one.

One, that's real and worth crediting.

Defense in-depth on the model does raise the cost of an attack.

On the other side, automated attackers have blown past that cost.

The Jailbreak Zero work published through ACL in twenty twenty-six reports attack success rates of ninety-nine point five percent against GPT-4o and ninety-six percent against Claude 3.5 with human-readable prompts, and it keeps working even after the victim model undergoes fresh safety alignment, too.

Sit with that pairing for a second.

Thousands of hours of expert humans struggle against a hardened classifier, and then an automated system walks through frontier models almost every time.

The guardrails are real.

They are also not a wall.

Every generation ships stronger safety training, and every generation gets broken again on a schedule the defender doesn't control.