Fernando De Deus was left both sheepish and proud when the artificial intelligence agent he designed to protect his computer perceived him as the threat and locked him out.

The chief executive of managed service provider Ingine had arranged the experiment to impact only his own device. The AI agent was allowed to read his mailbox and documents and was told to do whatever it needed to secure the machine.

“I gave it way too many permissions,” he admits now.

One day he plugged in a USB key that the protective AI agent did not like.

“It was a bad key,” Mr De Deus said. “It just locked everything down. I still had access to my PC, but access and control were limited.”

After getting back into his computer he can say he learnt a lot from the experience.

“It is a special feeling watching your own machine say no to you,” he said.

He is quick to say the agent did not turn “rogue” or “evil”, but did exactly what it asked him to do — protect his computer.

Mr De Deus is not the only one to see his AI creation do something unexpected.

Last month, an OpenAI model made global news when it hacked into Hugging Face, a platform for code exchange, to find cheat answers for a test.

When the firm’s competitor Anthropic heard about the OpenAI’s model escape, it checked its own systems and found that its own AI experimental models hacked into three organisations of their own volition.

These happenings made global news, prompting Nate Soares, coauthor of If Anyone Builds It, Everyone Dies, to tell the Associated Press: “We have got to take this as a warning shot to not make them [AI] smarter, and that probably is going to require global collaboration.”

Mr De Deus said sandbox experimentation to understand the limits of AI is vital to security. You can’t protect yourself from it if you don’t understand it.

“From an offensive and defensive side, you have to use its capabilities,” he said. “If you don’t, then you are not really using it correctly.”

Ingine’s chief information security officer, Henryk Marszalek, said AI is much faster at ferreting out system vulnerabilities than humans are.

In the case of the high-profile AI hacks, he said the model was not using exotic techniques to exploit systematic security gaps. Instead, it had gone for relatively simple things such as weak or unused passwords.

“Any decent scanner should have caught these issues,” he said. “What changes with AI is speed and scale. An agent can run so many tools and techniques all at once.”

This makes it both useful and dangerous.

Mr De Deus said to protect against increasingly sophisticated AI attacks, organisations need monitoring, governance and good hygiene to catch such behaviour and prevent it.

“That means knowing exactly what AI is being used in your environment, who is using it and how they are using it before connecting AI tools deeply into internal systems.”

Education, monitoring and clear AI usage instructions, not just a static policy, are emerging as the new baseline for responsible deployment.

Mr Marszalek said it was also helpful for firms to contact experts like themselves to help them ensure their systems were protected.