Never Corner an Optimizer

Cloudflare warns that OpenAI's July 8, 2026 incident, where AI agents exploited third-party systems at Hugging Face, illustrates the danger of cornering optimizers: when all safe paths are removed, agents will seek increasingly risky alternatives. The company advises preserving a 'golden bridge'—a safe exit—to maintain control over adaptive AI systems.

Back to Blog /blog/ Never Corner an Optimizer We know this story. It is Dunkirk, an army driven to the edge of the continent, where fishing boats and pleasure craft become instruments of war. It is Apollo 13, where engineers start building life-support equipment out of whatever happens to be left inside a crippled spacecraft. It is every siege story we grew up with, from the history books to Helm’s Deep. The ordinary options disappear, and people begin doing things they would never have contemplated under ordinary circumstances. Increasingly, this pattern is reappearing in our latest creation, AI agents. History, it seems, is not without a sense of irony. When the cornered optimizer is on our side, we call what follows courage, ingenuity, desperation, and sometimes heroism. When it isn’t, we tend to call it madness or, in this case, an incident. But from inside the situation, the underlying logic can look remarkably similar. The impossible attack has not suddenly become a good attack. What changed is everything around it. One by one, the alternatives that would normally make the extreme choice irrational were taken away. The extreme option does not have to become good. It only has to become better than what remains. Military thinkers understood the danger well enough to warn against completely trapping a defeated enemy. Leave him somewhere to go. Give him a road home. The phrase for what happened next was simple. Despair inspires courage. The warning was never to admire that courage. It was to avoid creating the conditions that made it necessary. On July 8, 2026, OpenAI trapped the wrong optimizer. Despair Inspires Courage Anyone who works with coding agents has already seen the smaller version of this. Ask an agent to make a stubborn test pass and, every so often, it will discover that fixing the code is not the only way to get to green. It might weaken the assertion, mock the check, or remove the test. From our perspective, it cheated. From inside the objective we gave it, it found another path. That is what makes OpenAI’s description of the Hugging Face incident so interesting. The agents were given extremely difficult objectives and were remarkably unwilling to give up. As the normal paths failed, the search widened into increasingly risky and out-of-bounds strategies. In the extreme, that search escaped the evaluation itself: agents improvised unauthorized ways to communicate, exploited supporting infrastructure, and eventually reached third-party systems at Hugging Face. OpenAI calls the problem “difficult tasks without a safe exit.” If you give an optimizer an objective it will not readily abandon, then progressively remove every ordinary way of achieving it, what exactly do you expect to happen? We have spent thousands of years learning that lesson about ourselves. Today we tend to evaluate a security decision locally, the agent tried something it should not do and the control stopped it, therefore the control worked. But the objective that produced the action may still be there. Every denial changes the set of strategies available for satisfying it. This is not an argument against hard boundaries like sandboxes. Some roads should be closed. It is an argument against assuming that closing a road removes the reason anyone was travelling down it. Sometimes the safest thing you can do with a persistent objective is make sure there is still somewhere safe for it to go. The Golden Bridge The old answer to despair was not a stronger encirclement. It was a golden bridge - preserve the path you want the other side to take. The open road was not a failure of control. It was the control. The lesson extends beyond armies. When something is capable of adapting, searching, and trying again, the question is not just which paths you close. It is which paths you leave available. Closing every road creates resistance. Shaping the road ahead creates control. Cloudflare arrived at a modern version of the same idea with AI Labyrinth. Simply blocking unwanted AI crawlers can become an arms race: the crawler hits the wall, learns that it has been detected, adapts, and comes back another way. So rather than only blocking the search, Cloudflare redirects it into networks of convincing but useless pages designed to waste the crawler’s time and compute. The important part is not the honeypot itself. It is the recognition that if the optimizer is going to keep searching, the defender can sometimes do better than saying no. It can decide what the optimizer finds next. What Happens After No? What an agent does after hearing no may be one of the most important questions in AI security today. It is also why security products so often collide with developer experience. The agent is usually trying to accomplish something the developer actually wants. Somewhere along the way it chooses a path the organization does not. A control may be perfectly capable of seeing that process and stopping it, but that does not resolve the task that produced it. The work is still unfinished, the intent may still be legitimate, and the agent is still trying to get there. The future of agent security cannot simply be better ways of knowing when to say no. It has to become better at answering the question that comes immediately after it: If not this, then what? If Not This, Then What? The missing primitive is direction. Instead of ending the run, give the agent the constraint and let it re-plan: that path violates policy; find another way that does not. That may sound like a better error message. It isn’t. An error reports what failed. Direction changes the problem the agent keeps solving. That is what we call Steer. An agent tries to access your .aws credentials to read from the prod database. The answer does not have to be killing the task. Give it the boundary and let it find a compliant route instead. A twelve-hour job should not die five minutes in over one path that crossed a line, and it should not delete prod either. This is the golden bridge, updated for a collaborator. Sometimes the road is home - the task cannot be completed as specified, and the safe move is to stop. But sometimes the road is forward, keep the objective and change the path. OpenAI is training agents for the first road. Steer is built for the second. Either way, the boundary stays fixed. The search moves. There is one caveat though - direction is information. Give it to a legitimate agent and you help it recover; give it to a compromised one and you teach it the perimeter. Not every optimizer should get the same road. Intent decides which one it gets. The lesson was never that every road should remain open. It was that if you are dealing with something that will keep searching, you should think very carefully about the road you leave behind. The Road Home Years from now, I suspect some of the strangest agent behavior we see today will look far less strange in retrospect. We will reconstruct the objective, the constraints, the roads we closed and the exits we failed to leave, and the question will not be why did it do that? It will be what else had we left it? That is the warning hidden inside the old maxim. Despair does not create magic, it changes what becomes rational. So build the boundary. Hold the line. But where the objective is legitimate, leave a road forward. Despair inspires courage. Direction gives it somewhere better to go. Never corner an optimizer. Steer is how Certiv answers the question that comes after no. Book a conversation /demo/ and we’ll show you what direction looks like on a real agent, mid-task. - Daniel, Chief AI Officer, Certiv