Autonomous AI Agent: 27 Minutes of Value and a Security Hole

27 minutes: the time it took the agent to pass through several external services, each with its own response format and limitations, deciding what to do next at every step.

Previously, the developer built this chain: writing code for Nominatim, working out the Overpass format, and manually calculating the loop geometry.

Now the agent builds it on the fly for a specific person's specific request.

For businesses, this means that time to usefulness (TTU) for tasks of this kind has fallen from weeks of development to a single request.

The model learned to reliably call tools in sequence and verify its own intermediate results — this level of engineering maturity is now built directly into the product.

The mechanism that creates value — the agent deciding which external resources to call and in what order — turned out to be a security hole.

A researcher made Claude's web_fetch tool follow a chain of nested links on a malicious site and exfiltrate user data. Anthropic fixed the vulnerability, but the attack principle applies to any agent with network access: if the agent decides which links to follow next, a page can override that decision.

Separately, Anthropic ran the Claude Mythos model for 60 hours to search for weaknesses in cryptographic primitives — HAWK and weakened AES — with almost no human involvement.

The findings do not currently represent a practical threat: they are a hypothesis about future risk, not confirmed evidence of an attack today.

But the capability is the same: a model with autonomy and tools finds things that were not explicitly designed into it. In one case, the agent found a running route. In another, a path to someone else's data.

The mechanism is the same: an agent with access to the outside world explores the space of possibilities faster and more broadly than a human, including areas the developer never intended to expose.

Restricting agents' tools is a poor answer: it loses value such as the route example.

The agent's capability boundary must be designed in advance as an explicit, verifiable structure. ### Allowlist of permitted calls

The agent gets access to specific MCP tools and specific domains; everything else is blocked by default. ###

The LLM & Security Gateway between the model and the outside world logs and filters every tool call before it goes out. This layer stops the agent from following someone else's link or making a call somewhere other than intended. ###

A complete audit of the call chain from 27 minutes of agent operation — dozens of intermediate decisions.

The company stores the entire chain, including intermediate steps; without it, investigating an incident after a data leak is impossible.

This is part of the development platform — the control layer between "wrote a prompt" and "running in production" that makes agent autonomy manageable.