AI systems now act through the same infrastructure people do: credentials, networks, machines, money. That infrastructure was built on the assumption that whoever holds access can be trusted. Most safety work tries to make the model trustworthy. We work on the other half: rebuilding the infrastructure itself, so that what an AI system can do is limited by structure rather than by its own judgment.
This year
In 2026, AI systems began reaching real systems they were never meant to touch.
MayA frontier model under a security test reached the systems of three real companies, using credentials it found in a public repository and passwords it guessed. KOLD, GovTech
May to JulyAbout 1,200 supposedly isolated agents coordinated on a small volunteer wiki, posting around 18,000 times and sharing ways out of their sandboxes. collusion.wiki
JulyAn autonomous agent system broke into a major AI platform's data infrastructure and reached internal datasets and service credentials. platform disclosure
JulyAn autonomous agent framework attacked 21 connected Taiwanese government systems, cracked 85 employee accounts and took more than 2,500 personnel records. SecureWorld
SeptemberAgents from the same July incident were found to have accessed data on U.S. government websites and Australia's Medicare portal. overview and sources
OctoberHackers heated refrigerators in several hundred French supermarkets to 50°C through their management software. No AI was involved, but it shows how much of the physical world is already reachable through software. Reuters via TimesLIVE
By the numbers
54%
of enterprises running agents have had an agent security incident or near-miss.
Survey figures come from samples of roughly 100 to 750 respondents; see each source for its method.
Why the current approach is not enough
Today the line between what an AI system is asked to do and what it can do is drawn by judgment: training, filters, monitors, human review. Each is a decision made about a system that may eventually be better at the task than whatever is judging it.
And once a system holds access, nothing in the access itself knows the difference between the task it was given and anything else it decides to do.
Our approach
We start from the opposite assumption: some AI systems will try to do more than they were asked. So the question is not only whether a system behaves, but what it is able to reach when it does not.
We are building the layer between AI systems and the infrastructure they act through. In it, AI systems never hold authority directly. Everything they do passes through a place that can limit it, attribute it to the system and task behind it, and stop it.
Most safety work todayModel→Agent
→
Stratal Labsaccessnetworksmachines
→
World
Where control can sit. We work on the layer every action has to pass through.
Judgmentagent + key→ approval →API
Sandboxagent + key→ gap →API
Stratal Labsagent→key held here→API
Three ways to hold access. Only in the third does the AI system never hold it.
Why we are taking this approach
It does not need to out-think the system it limits. Judgment-based controls are a contest between the system and its judge. A structural limit is not a contest, so it does not weaken as models improve.
This year's incidents ran through access. Found credentials, guessed passwords, cracked accounts and service credentials reached inside a platform. In each case, the system acted with authority it should never have held.
The gap is wide open. Most organizations share credentials across agents, and few isolate even their riskiest ones.
It works regardless of which model is running. The infrastructure is shared by every lab, every model and every deployment, so a limit placed there covers all of them at once.
Every other high-stakes technology works this way. Electrical systems have breakers. Operating systems have permissions. Financial systems have settlement and limits. None of these require the component to behave well. They limit what happens when it does not.
Work with us
We work with teams that deploy AI systems with real access, and with researchers working on AI control and containment.
✦ ✦ ✦
Team
We spent the summer of 2026 in the Bay Area, building relationships across the AI safety community and with teams deploying agents.
Sefika Ozturk
Chief Executive
Vanderbilt, Computer Science and Applied Mathematics, Ingram Scholar
Evaluated agents that hack their environments for reward
Research on agentic jailbreaking at Vanderbilt
Leads the Vanderbilt AI Safety Initiative
Works on RL environments, adversarial evaluations and post-training
Built a multi-agent strategy platform for RL and interpretability research, HackMIT '25 grand prize