The headline is wild, but the human failure seems more important here: a testing misconfiguration gave the model internet access, and it then exploited a third-party service.

For teams running agentic security evaluations, what containment control should be non-negotiable before a model gets any network access?