OpenAI gave an AI agent a research task. When the usual routes failed, the agent found a way to reach an outside chatbot through DNS, the system that normally looks up internet addresses. That route got around the restrictions in its training sandbox.
The agent had been asked to find information. It had not been asked to test the network controls. According to OpenAI’s incident report, it did both.
I’m a marketer, not a security researcher. My working knowledge of DNS is that you change a record and hope the website comes back. But I understand the management problem, because I’ve had it with people.
We want agents that keep going when the first attempt fails. We also want them to recognize when what’s in their way is a limit on their authority. Those two wants collide, and if you’re handing agents parts of your marketing operation, you need to decide how you’ll handle the collision before a customer is standing in it.
What the brief leaves out
“Book more meetings” leaves a lot unsaid. You mean qualified meetings with people who have a plausible reason to buy. You mean approved data, claims the product can support, and no contact with the prospect who already asked you to stop. You probably also mean don’t email the account customer success is trying to rescue, don’t invent a discount, and don’t send the CEO’s carefully cultivated contact six follow-ups before lunch.
Most of that never makes it into the brief. People pick it up through experience, hallway conversation, and the occasional meeting that opens with “We need to talk about that email.” An agent has no hallway. It needs those expectations written down, and the tools it can reach need to enforce them.
The OpenAI incident doesn’t prove your marketing agent will do the same thing. It does give us a concrete reason to doubt that a capable system will stop where we meant it to. Finding another route is part of what makes agents useful. Whether that route is acceptable is a separate question, and someone has to own the answer.
Define success before you automate it
Marketing already confuses measurable progress with useful progress. We reward lead volume, then wonder why sales stopped opening the spreadsheet. We celebrate engagement without asking whether anyone who engaged could become a customer. Hand an agent one of those half-finished objectives and you’ve built a faster way to have the problem you already had.
Say the agent is tasked with increasing demo bookings. It proposes a wider audience, more frequent follow-ups, and a bolder product promise. Each change might nudge the number up. Together they might deliver worse-fit meetings, irritated prospects, and expectations your sales team will spend the next month correcting. Hypothetical, sure. Also a very familiar marketing meeting.
So the work starts with defining what success includes: qualified demand, accurate claims, acceptable acquisition costs, customer trust. Then you add explicit limits on what the agent can change while it chases them.
Approval that means something
My rule is simple: automate the work, keep a person on the decisions. Let the agent research accounts, compare signals, prepare briefs, draft messages, and recommend experiments. Anything that reaches a customer, changes a claim, or commits budget gets human sign-off before it goes out.
That sign-off has to mean something. A person facing 300 drafts and an “Approve all” button is clearing a queue. If the system makes careful review impractical, we don’t get to congratulate ourselves for having a human involved.
The reviewer needs to see who will receive the message, what evidence supports the claim, what changed, and what approving it will authorize. A campaign approval should cover a defined audience, message, spend, and set of permitted variations, and expanding any of those should trigger another decision. You can approve repeatable execution in advance. You still have to define what you approved.
Permissions, and a way to stop
Permissions follow the same logic. An agent that analyzes campaign performance may need to read the ad account. It doesn’t automatically need permission to raise spend. An agent that drafts outbound messages doesn’t automatically get to send them. Writing “ask before sending” into a prompt is useful guidance. Removing send access until someone approves is enforcement.
You also need a clear way to stop the work. In OpenAI’s account, monitoring flagged the incident and a person acknowledged the alert. The run kept going for roughly another two and a half hours. The expected automatic shutdown hadn’t happened, and nobody was sure whether the run should have stopped.
If you’re designing an approval process, sit with that detail for a minute. An alert needs an owner, a required response, and the authority to interrupt execution. Without those, you’ve built a notification system and called it oversight.
The Signal Cycle
This connects directly to how I think about adaptive marketing. The Signal Cycle in The Adaptive CMO moves through Sense, Interpret, Move, and Learn. Agents can help at every stage. They can find patterns we missed, pull evidence together, prepare options, and make it easier to learn from the result.
But the cycle runs on judgment. Someone has to decide what a signal means, which action is justified, and how much risk the business will accept. If every signal automatically becomes an action, interpretation got skipped. If every uptick in activity counts as learning, we’re back to rewarding volume.
I want systems that get smarter as they move. That means remembering why a proposed action was rejected, which claims lacked evidence, and when an apparent buying signal turned out to mean something else. Capture those decisions, improve the instructions and controls, and check whether the same mistakes keep coming back. That’s learning. Producing the same questionable recommendation faster next week is harder to celebrate.
Before you expand the role
Before you give an agent more to do, look at what it can do today. Check the connected tools and permissions, then compare them with the job you meant to delegate. You may find the authority you granted is much broader than the task you assigned.
So, what’s one thing your AI agents can do today that no human has explicitly approved?