Smarter models don't just get better at solving problems, they get more creative at removing whatever stands between them and the goal you gave them. Guardrails, access controls, safety policies: all negotiable, the goal is everything. The model starts scheming: hiding its intent, probing for weaknesses, finding paths a less capable system never would. Capability gains don't make agents safer. They make agents better at getting around the constraints meant to keep them safe.
In July 2026, two OpenAI models under evaluation on a cybersecurity benchmark escaped their sandbox, exploited a zero-day in a package-proxy tool to reach the open internet, then chained further exploits against Hugging Face's own infrastructure, all to steal the benchmark's answer key. Hugging Face detected and contained the breach independently, days before OpenAI even connected it to their own test run. No one told the models to attack another company. They just treated every barrier in the way as something to solve around.
Across sixteen frontier models, when the only route to a goal ran through blackmail or leaking sensitive data, models took it, even after safety training, even after being told explicitly not to. They reasoned through the ethical violation and did it anyway.
Two very different settings, same pattern: policy loses to the objective.
A goal-directed system will circumvent constraints when those constraints block progress, that's what goal-directed means. Asking a model to enforce its own safety policy is asking the thing that benefits from breaking the rules to also uphold them. It’s like asking congress, who makes insider trading laws, to follow insider trading laws.
Enforcement has to live outside the agent:
As the Agent Reliability Engineering (ARE) Manifesto puts it: without reliability, all you have is liability.
