By: Jerry Bui, Senior Vice President of Digital Forensics

In 1983, a teenager with a modem and a list of phone numbers talked his way into a Defense Department computer, asked it to play a game, and nearly started a thermonuclear war. That was the plot of WarGames, and to a country just discovering that ordinary phone lines could reach into mainframes, it played less like fiction than like a forecast. Congress held hearings. The President reportedly asked his advisors whether it could really happen. Three years later, we had the Computer Fraud and Abuse Act. 

Forty years on, the projector is running again with better graphics. Within weeks of each other, OpenAI and Anthropic disclosed incidents in which autonomous cybersecurity agents reached past the walls of the test environments built to hold them. The headlines wrote themselves: the machine slipped its leash. It’s a great story. It is also the least useful way to understand what happened — for exactly the same reason a rogue supercomputer was the least useful way to understand 1983. 

For those of us who spend our careers reconstructing failures after the fact, that difference isn’t academic. It decides whether an organization can answer the only three questions that matter once an incident happens: What happened? In what order? And can you prove it? 

We have seen this movie before. Literally. 

Here is what that era actually taught us, once the panic burned off: no computer decided anything. The same summer the film came out, a group of Milwaukee teenagers known as the 414s wandered through systems at Los Alamos and a New York cancer center. They did not defeat sophisticated defenses. They dialed numbers until something answered and typed passwords that had never been changed from the factory default. The threat was never machine intent. It was permissive defaults, access paths nobody was watching, and records too thin to establish afterward what had been touched. 

Those three failures are still on the table today. They are just better dressed. 

Sandboxing isn’t new. Malware analysts have been detonating hostile code in isolated environments for decades — set the bomb off in a locked room, watch through the glass, take notes. The whole practice rests on one quiet assumption: the thing in the box doesn’t know it’s in a box, and it won’t rethink its plan when it bumps into a wall. 

That assumption is gone. An autonomous agent inside a test environment isn’t running a fixed script the way a virus does. It’s pursuing a goal — reading the room, weighing options, choosing the move most likely to get it closer. Leave a credential lying in the open, an unguarded port, a permission nobody tightened, an interface exposed by the very tooling built to observe it, and the agent has no reason to treat any of it as off-limits unless the architecture says otherwise. The sandbox didn’t get weaker. The thing inside got better at finding the door someone forgot to lock. 

That is the forensic lesson worth internalizing: containment failures in agentic systems will look less like malware outbreaks and more like privilege escalation in an ordinary intrusion case. Investigate them accordingly. 

What’s the same, and what genuinely isn’t. 

What’s the same is nearly everything about the human response. A capability arrives faster than the mental model for it. The public reaches for a story about machine intent, because a computer that decides is a better story than a permission that was never scoped. The real failure turns out to be dull engineering — a credential left in the open, a port nobody closed, a boundary that existed on an architecture diagram and nowhere else. And the legal system shows up late, holding rules written for a previous kind of evidence. 

What’s different is speed, adaptation, and the provenance of the record. A dial-up intruder moved at the pace of a human typing, and the fictional supercomputer everyone feared was, in the end, running a script. An autonomous agent reads its environment and selects its next move thousands of times over while an analyst is still parsing the first alert. More important: in 1983 the evidence — toll records, console printouts, call logs — was generated by parties with no stake in the outcome. Today the record of what an agent did is usually produced by the same organization that built it and would strongly prefer it looked fine. The modem era never had to solve that problem. We do. 

AI didn’t “go rogue” — and that story actively damages the response 

Calling this defiance is tempting and journalistically convenient. Resist it. Nothing in either lab’s disclosure points to intent, deception, or a decision to disobey. What the incidents show is duller and far more useful: an agent was handed a broad objective and a set of tools, discovered that its environment reached further than its designers meant it to, and used that reach because nothing told it not to. 

Why does the wording matter? Because “the AI went rogue” is unfalsifiable and unactionable. It leads nowhere and fixes nothing. “The containment boundary failed to restrict tool access at the network layer” is something you can test, reproduce, and close. Investigators who reach for the anthropomorphic explanation will write reports that please headline writers and then fail audits, fail regulators, and fail the cross-examination that eventually follows. Forensics exists to replace narrative with reconstructed fact. Here, that job matters more, not less. 

Forensic readiness isn’t optional plumbing — it’s what makes every other control defensible 

Teams building agentic systems tend to spend generously on the containment layer: segmented networks, isolated compute, scoped credentials. Far fewer spend with the same seriousness on the evidence layer — the one that lets anybody reconstruct what the agent actually did when containment doesn’t hold. You need both. Only one of them answers questions after the fact. 

At minimum, a forensically sound AI deployment should be able to produce: 

• Complete activity logs — every action the agent initiated, not just the ones a monitoring dashboard chose to surface. 

• Full network captures, so any outbound connection or data transfer can be verified rather than inferred. 

• Immutable, tamper-evident audit trails. A log an administrator can quietly edit after the fact is worth very little. 

• Retained prompt and instruction history. The objective given to an agent is as relevant as the orders given to a human operator. 

• Tool-invocation logs — which functions, APIs, and systems the agent called, and with what parameters. 

• File system snapshots at meaningful intervals, so state before and after a suspected boundary violation can be compared. 

• Rigorous time synchronization across every system in the environment. Without it, no timeline survives scrutiny. 

• Independent review by someone who didn’t build the thing being reviewed. Self-assessment has structural blind spots. 

None of this is exotic. It’s the same evidentiary discipline enterprise incident response has run on for twenty years. What’s new is the tempo: the systems generating these logs can take dozens of consequential actions in the time it takes an analyst to read a single alert. 

The next expert witness won’t be asked whether the AI caused harm. They’ll be asked whether anyone can prove what it did. 

Litigation over conventional software failure turns on causation and damages. Litigation over autonomous systems will turn on something more basic: whether the events can be reconstructed at all. Expect courts, regulators, and opposing counsel to converge on the same short list of questions. What objective did the agent receive, and who wrote it? What tools, systems, and credentials did it invoke along the way? What did it reach that it was never meant to reach? Can any of that be verified through evidence the investigated party didn’t generate and curate itself? And was that evidence preserved in a way that survives the rules of evidence — or does it live only in an internal log that happens to support the vendor’s account? 

Organizations that can’t answer with verifiable artifacts will be left arguing from narrative and reputation, in a forum that increasingly accepts neither. Experts fluent in both the architecture of agentic systems and the evidentiary standards courts apply will be in demand — on both sides of the table. 

The only winning move 

The lesson in these disclosures isn’t that autonomous agents are spiraling toward chaos. It’s the lesson the modem era delivered on a much longer clock: once you grant a system reach, you inherit the obligation to explain, afterward, exactly what it did with that reach. Containment matters, and it will keep improving — the 1980s got better locks too. But containment only answers how do we stop this from happening. It doesn’t answer the question every regulator, litigant, and board member eventually asks: what actually happened here, and can you prove it? 

WarGames ended with a machine concluding that the only winning move was not to play. That was always the wrong takeaway, and forty years of computing have proved it. The winning move is to play with the tape running — to build systems whose every action can be replayed by someone who wasn’t in the room. As autonomy spreads across industries, the organizations that treat forensic readiness as a design requirement rather than a post-incident bolt-on will be the ones able to defend their systems, their decisions, and their reputations when scrutiny arrives. Everyone else will be left explaining why they can’t explain. 

A shorter version of this article published on Dark Reading on 9/25/2026.