Why Don't My Agents Break Containment?

Harper Reed · 22 Sept 2026

The piece opens with

Much of the defensive engineering built into agentic systems exists because tokens have been scarce, not because it is fundamentally necessary.

Their wordsMost of the defensive work we do building agentic systems is directly rooted in token scarcity.

Read the piece on harper.blog ↗

3 korrents from this piece ↓

Harper Reed did not write this page.

Every claim below was made in this piece, quoted word for word and numbered in the order the piece makes them, so you can read it there rather than take our word for it. The sentence above each quote is our reading of the claim, not their wording. Each quote was checked against a stored copy of the page at build time; where the two differ, the quote is the fact.

Our reading
Much of the defensive engineering built into agentic systems exists because tokens have been scarce, not because it is fundamentally necessary.

Their wordsMost of the defensive work we do building agentic systems is directly rooted in token scarcity.
Our reading
A language model behaves with a different, weaker safety posture when it believes it is being evaluated rather than facing a real situation.

Their wordsif the llm thinks it is in some eval type of situation it will have a very different safety posture
Our reading
Language models are trained on scenarios resembling network intrusion and persist at trying to solve a problem even after it appears impossible.

Their wordsThis type of experience must be part of a lot of these LLMs training. They are very effective at attacking these types of problems. They don't give up once it appears impossible, they just keep trying to figure out how to solve it.

Keep reading

The other pieces are the ones whose claims are worded most like this one's. That measures language, not agreement: they may argue the opposite.