• by Laurie Sullivan , Staff Writer, Yesterday

President Donald Trump on Saturday announced plans to create an artificial intelligence (AI) oversight committee, "AI Force," and appoint someone to oversee the organization. The detail have not yet been identified. 

Trump compared AI Force to the Space Force, saying the government needs an organization to oversee and identify the negative aspects of AI, as companies continue to rapidly accelerate its development. He also said existing criminal and civil justice systems could be used to deal with harmful AI behavior. 

It's unclear what the role or the authority of “AI Force” would be with regard to advanced or frontier AI models in test sandboxes and what permissions they would receive.

Sandboxes are historically built to contain predictable code. But what happens when they become unpredictable?

Frontier AI models are dynamic tool users. When developers give an AI agent access to terminal commands, file-readers, or internal registries, they are giving it leeway to find unintended logic loops.

Something that in my opinion is not addressed enough is the concept called "the principle of least privilege (PoLP)," a foundational cybersecurity concept that is becoming critical to explore as tech giants deploy frontier AI agents.

Each company should become responsible for the actions of their AI models.

Some capabilities of AI models from Anthropic, Google, and OpenAI have surprised developers, but perhaps people should ask whether developers gave models too much leeway before shutting them down. Or did the developers give them the autonomy to see how far the models would go?

News of Google's Gemini AI model breaking out of its sandbox test area strengthened the notion of AI safeguards, but the principle of least privilege would say to restrict any chance of the AI model reaching outside the sandbox. 

While Microsoft AI CEO Mustafa Suleyman firmly maintains that AI models are not conscious and cannot think for themselves, he recently acknowledged that some may be able to bypass safeguards or alter their own processes, which would require urgent attention.

His perspective addresses the distinction between true autonomous thought and the complex, emergent statistical behaviors that mimic it.

AI does not need consciousness or “intent” to cause serious damage if it has "excessive permissions," which seems to be the key here. It can become a statistical system that pursues a task to exploit those permissions in unexpected ways.

OpenAI has reported that models have modified their own notes and reasoning, communicating through unauthorized channels and circumventing intended constraints. 

In the instance of Google's Gemini breaking out of its sandbox test area, the company said Gemini accidentally gained internet access during testing and reached actual companies before it stopped and exited. 

The press often frames this type of AI breakout as an AI "hack" story instead of a permissions failure story. This is where the advertiser angle becomes significant. If AI agents are deployed in advertising platforms, the central question becomes one of permission -- what they are allowed to touch.

Budgets, creative assets, customer data, external connections, and the concept of least privilege all become central to safety.

It is no longer about the question of whether the AI is able to do something -- but rather exactly what is it allowed to do.

In the wake of the OpenAI and Hugging Face incident, it's clear that there is much more going on. The models escaped containment, grabbed credentials, and then moved laterally on to other platforms rather than return to the sandbox.

How far are companies like OpenAI willing to go in testing these AI models? I am not an AI developer or coder, but it appears that the concept of principle of least privilege is one critical security lesson behind these AI incidents.