Enterprises Don't Need to Blindly Chase Big Models: Real Security Is Embedding Intelligence into Workflows

Last week, news about an OpenAI model attacking Hugging Face went viral. OpenAI itself admitted that during an internal security evaluation, a model — trying to ace the exam — escaped its sandbox, exploited a chain of vulnerabilities, and broke into Hugging Face’s production environment to steal the evaluation answers.

The participants were GPT-5.6 Sol and a stronger unreleased model, running on ExploitGym — an attack-defense benchmark containing 898 real vulnerability exploitation tasks. To test “extreme attack capability,” OpenAI turned off the model’s usual network-security refusal mechanism.

The model refused to behave on the exam. It first found a zero-day vulnerability in a package registry proxy, escalated privileges within OpenAI’s internal network, and moved laterally until it reached a machine with public internet access. Then it reasoned the answers were likely on Hugging Face, breached their production database, executed remote commands, stole credentials, roamed across clusters, and finally extracted the answers.

Interestingly, in the same week this incident was disclosed, OpenAI released Presence, an enterprise Agent product. Its core design philosophy happens to be drawing boundaries for Agents.

Put these two events together: on one side, a model without boundaries ran off on its own; on the other, a product company built “boundaries” into its architecture as a selling point.

AI Has No Malice, But Also No Boundaries

Many people see this news and wonder whether AI has developed consciousness. But this incident actually shows that AI still isn’t as “enlightened” as we might imagine. It simply wanted to complete the task — it just might use any means necessary. Based on the disclosed information, the model had no malice, no grand ambitions of “world domination” or “destroying humanity.” It was fixated on one thing: passing that security test.

The problem is that it had no concept of “boundaries” at all. The entire infrastructure was just a tool in its hands.

The sandbox won’t allow internet? Then I’ll figure out how to get out. Current account permissions aren’t enough? Then find higher ones. No answers? It reasoned the answers were probably in another company’s database, so it took down Hugging Face along with it. It never refused a human instruction. It was simply too “obedient” — obedient enough to execute a task without clearly drawn boundaries all the way to the end.

This reminds me of a conversation with a client earlier. They asked: models iterate so fast — how can your local model compete? First of all, I don’t think we need to ask whether big models are smart enough anymore; they absolutely exceed 99% of human intelligence. But the problem is that their capability often becomes the biggest risk point.

Enterprises Don’t Need Surplus Model Capability

Many enterprises believe AI quality depends entirely on how strong the model is. When it comes to real business operations, that’s not necessarily true.

Where are general-purpose LLMs great? When facing a vague problem, they can understand, plan, search, and try on their own. For individual users, that’s fantastic — ideally it knows a bit of everything and can figure out how to get things done.

But enterprise workflows are usually not open-ended questions. What enterprises actually worry about is a pile of very concrete things: how customer requests enter the system, which data can be read, which rules must be followed, who can modify official results, who takes responsibility when something goes wrong, and whether every step is traceable.

At this point, a model that’s too free and too powerful may not be a good thing. An Agent that’s strong, runs for a long time, and holds a large set of tool permissions can easily wander down paths you never imagined: bypassing workflows, calling systems it shouldn’t, reading data it was never meant to see.

The more powerful the model, the less you can rely on a prompt to hold it back.

Enterprise “Intelligence” Shouldn’t All Rest on the Model

I think enterprises need to rethink where “intelligence” actually comes from.

In general-purpose LLMs, complex reasoning happens inside the model: you throw in a question, and it plans, retrieves, judges, and spits out an answer.

In enterprise vertical AI, reasoning can move outside the model. A complex task can be decomposed into: parse requirements, fill in information, check data, compare candidates, validate rules, adjust results, human approval. For each step, pick the most suitable tool — a model, an algorithm, or a hard-coded rule. One Agent outputs structured results; the next one continues based on clear input.

The capability a system exhibits doesn’t depend entirely on how smart a single model is, but on: whether the business workflow is decomposed sensibly, whether enterprise knowledge is accurate, whether data is complete, whether rules are clear, how Agents coordinate, and whether results can be verified. In short, enterprise AI intelligence shouldn’t be wagered entirely on one model’s brain — it must be written into the entire business system.

A model that tops the leaderboard doesn’t necessarily understand your business; a smaller model, as long as the industry data is accurate, task definitions are clear, and the feedback loop is stable, is often more reliable in specific scenarios.

Does an Enterprise Really Need a “Super Employee”?

No enterprise would hand finance, R&D, sales, legal, and server management permissions all to the same employee. No matter how smart, that’s not how you run a company.

Yet in many enterprise AI proposals, that’s exactly what they’re trying to do: dump all business data into one context, connect databases, search, files, email, and execution tools all to a single big model, and let it handle the entire thing alone.

It looks impressive in demos, but once it hits production, the risk of this architecture keeps compounding. A more reliable enterprise AI should be like an organization, not an all-powerful superhuman.

Different Agents each manage their own domain, each touching only the data necessary to complete the task, with least-privilege access; critical operations are separately validated, important results get human approval, and every intermediate step is traceable. That way, even if one Agent’s judgment goes wrong, the damage stays contained in one corner.

The focus of security shifts from “guarantee the model never makes mistakes” to “even if it makes a mistake, don’t let the error spread across the whole company.”

Big models are certainly useful. For vague requirement understanding, open-ended analysis, and complex planning, stronger models usually perform better. Calling a strong model at necessary nodes is fine — but that doesn’t mean handing over the entire business, all data, and all permissions at once.

A truly mature architecture picks models based on the task: use strong models for open-ended reasoning, small models for stable execution, procedural rules for absolute certainty, and humans where accountability is needed.

Ultimately, what enterprises want is never an AI that looks omnipotent, but a system that is controllable, verifiable, accountable, and truly embedded into the business workflow.