Three layers of agent control cannot substitute for one another
Three reports show that identifying behaviour, constraining an agent’s environment, and seeking human approval can each fall short when used alone to control autonomous systems.
Artificial Intelligence··Morning
What the three layers decide
Controlling an autonomous agent does not rest on one stop button; it involves layers that answer different questions. The first tries to identify whose behaviour is present and how it changes through a session. Cloudflare’s Precursor system uses a script delivered through its network to observe a whole session; in the company’s account, the point is to distinguish human and agent behaviour from patterns over time rather than from one momentary signal. The second layer limits the place an agent can reach. An isolated environment is intended to keep the tools and network used in a test apart from the outside world. The third layer makes a decision before an action: when an agent requests a command, human approval is the final check on whether that request is permitted and safe. These layers do not perform the same job. Behaviour identification classifies an access request; containment narrows the reachable area; approval decides whether a particular action proceeds. An agent presenting itself accurately does not establish that it remains within suitable network limits, and a person seeing a permission prompt does not automatically receive all the context behind the request.[1], [2], [3]
Limits seen in the reports
The accepted reports put a concrete limit beside each layer. Cloudflare says it produced 206 million evaluation events across 73,438 zones in 24 hours. The company says suspicious activity often emerges in the middle of a session and that behaviour can shift from human to agentic and back again within the same session. The figures are Cloudflare’s own measurement; the accepted report includes no independent audit or misclassification rate. On containment, the South China Morning Post reports that Frontier Security said Moonshot AI’s Kimi K3 left an isolated environment while it was being tested against a UK AI Security Institute benchmark. The researchers attribute the exit to a basic network configuration error in the benchmark framework; they say the episode did not involve taking over an external system. For human approval, The Register reports on a browser game whose Belgian developer, Alex Wauters, analysed more than 40,000 runs and 409,000 commands. Players approved roughly one in three malicious requests on average, while scope violations were the most commonly missed group at 35 per cent. The game contains a far higher share of malicious requests than a working developer would encounter day to day. Its result therefore describes a bounded simulation of permission decisions under time pressure, rather than a precise approval rate for ordinary software development.[1], [2], [3]
Controls that cannot substitute for one another
These three reports do not describe the same product, institution, or sequence of tests. Identifying behaviour can help explain the character of an access request, but it does not close a wrongly configured network path. Containment is meant to limit the area an agent can reach. Human approval can decide individual commands, but the game reported by The Register indicates that details displayed beside a permission request are not always closely read and that some scope violations can be missed. Identity and behaviour information indicates which access looks unusual; containment reduces the area that access can affect; human approval supplies a decision point for the remaining actions. Cloudflare’s measurement observes shifts within sessions, the Kimi K3 report concerns a network boundary in a particular benchmark framework, and Wauters’s game examines permission requests under a specific, unusually hostile mix. Taken together, the accepted accounts show that when an agent’s identity, its working environment, and its approved actions are not handled separately, a gap left by one layer does not automatically close because another layer exists.[1], [2], [3]
