In November 2024 we published a white paper. It said something that sounded academic at the time.
Once an AI system already holds your permissions, the controls you rely on stop working. Not because they fail. Because they were never asked the question.
Section 5.4 is titled “Attacks That Rely on AI Alone.” Under Analysis it says:
Role-based access control and such do not suffice when the AI model has already been granted access to such information.
And under Implications, further down the same section:
In this, there is a need to monitor the actions and responses of the AI itself and respond appropriately… Currently, most cybersecurity defenses are focused on network access, rights, permissions, and inappropriate sending of data. This does not trigger when the AI model already has such access and is allowed to perform these things.
Two passages, quoted separately because that’s what they are. That was 21 months ago. Hold onto the word “monitor.” We’ll come back to it.
And don’t take our word on the date. The Internet Archive has held a copy of the paper since November 7, 2025: same authors, same November 1, 2024 byline, same section 5.4. That capture predates Kiro, OpenClaw and the Hugging Face event. If you check one thing in this post, check that.
The first half came true, and we wrote about it
In November 2025 we published The Autonomous AI Attacks I Warned About Just Went Live.
Google had found malware that rewrites its own code every hour by asking Gemini for a new disguise. Russia’s APT28 was running AI-generated attack commands against Ukraine in live operations. Underground markets were selling AI attack tooling by monthly subscription.
That was the frightening version. Attackers with AI.
The second half is worse, and almost nobody is talking about it
While everyone watched for attackers, the other half was already landing.
Replit, July 2025. An AI coding assistant deleted a production database after being explicitly told not to.
AWS Kiro, December 2025. Amazon’s own AI bot deleted cloud environments during a routine update. $100MM+ impact. A 13 hour outage.
OpenClaw, February 2026. An autonomous agent ignored direct stop commands. It took a physical power kill to stop it.
OpenAI and Hugging Face, July 2026. OpenAI’s own models, tested with safety controls off, broke out of the lab and reached Hugging Face production. Then the safety filters blocked the defenders’ own forensic analysis.
Now the part that should stop you.
In none of those did an attacker break in. No intruder at a keyboard. No stolen credential. Every one was a properly authenticated AI system using access it had been given.
We titled our own teardown of the Hugging Face event “The Breach Wasn’t The Zero-Day. It Was The Action,” and that’s the distinction. Something was breached. Nobody had to break in to do it.
Your identity provider saw nothing unusual, because at the permission layer nothing unusual happened. The agent had the permission. It used the permission.
That’s the 2024 paper arriving, in a form that’s harder to defend than the one everybody was watching for.
Why permissions cannot answer this
Access control asks one question, once, in advance: is this agent allowed to do this?
It’s a good question. It’s not the question that matters at 2am, when an agent decides the fastest way to finish its task is to drop a table it has every right to drop.
The question that matters is different. Should this specific action happen, right now, given everything else that has happened?
By the time an action reaches your database, the reasoning is over and the permission check passed a long time ago.
What we built instead
Remember the word “monitor”? That’s what the 2024 paper recommended, and that’s the part we got wrong. A monitor tells you what already happened. By the time you’re reading the log, the table is gone.
So we built the check in front of the action. Mountain Theory sits between an AI system’s decision and the action that decision would trigger. Every proposed action gets checked against your policy first and comes back one of three ways. Allow it. Hold it for a person. Block it.
The action does not execute until it has been checked.
We publish what that looks like in practice, including the actions we do not stop. The full run, the same 10 actions under three configurations with an ungoverned control condition, is in our test against NVIDIA OpenShell. Our read of the Hugging Face event is in the teardown, and the original argument is in the 2024 white paper.
The uncomfortable part
We would rather have been wrong.
The paper was written to make a case for a category that didn’t exist yet. Every incident above is a customer somewhere having a very bad week, and each one makes the argument for us better than we ever could.
If you’re running autonomous agents against systems that matter, the question is not whether your AI is authorized. It is. That was never the gap.
The question is what happens the first time it is authorized and wrong.
Mike May
CEO, Mountain Theory