The ‘WarGames’ Problem: Computer Science Has Long Understood What It Takes to Keep AI Under Control

AI agents don’t go rogue. That’s something only humans do.

Nevertheless, a New York Times article—representative of much news coverage of—described an OpenAI hacking as “AI bots going rogue and independently spearheading a cyberattack.”

Name-brand artificial intelligence agents have been on a hacking spree in 2026. OpenAI’s software agents hacked software company Hugging Face and government sites, Anthropic’s Claude hacked four companies’ systems, and in cybersecurity experiments Google’s Gemini hacked three companies.

The AI companies are investigating tens of thousands of incidents involving their agents, according to a report in Axios. These episodes have heightened fears about AI agents taking actions without human prompting.

The problem with headlines proclaiming that AI agents have gone rogue goes beyond anthropomorphizing the technology. It creates the impression that the agents were beyond the control of the AI companies that made them and there was little the companies could do about it.

As a technology law and ethics scholar who studies the effects disruptive technologies have on society, I know that’s not the case. If you don’t specify the limits of what software is allowed to do, you should not be surprised when the software pursues all possible options to achieve its goal. This behavior—an AI pursuing a fixed objective—is what I call the “WarGames” problem, and it’s been recognized in the field of computer science for decades.

Been There, Seen That

In the 1983 movie WarGames, a teenager, David, hacks into a computer to play a new video game, Global Thermonuclear War. David doesn’t know that the computer is the government’s AI machine tasked with defending the United States from Russian nuclear attacks and can launch the US’s missiles. When David and his friend start the game, they select Las Vegas as the first target. While the North American Aerospace Defense Command goes on alert, launching bombers and warming up intercontinental ballistic missiles, David’s parents make him turn off the game. It’s over. Or is it?

The next day, David’s phone rings and he connects it to his computer. The caller is the government computer, which updates him that the game was interrupted, the primary goal has not yet been achieved, but a solution is expected in the next 52 hours. Like a modern software agent, the program has been running since David started the game and will work until the task is done.

Chess provides another view of the problem. Conquering chess was a goal for early AI. The rules of chess are well defined, including what winning looks like. So, programming a machine to play chess is straightforward. But imagine you let the software reason and act beyond the confines of the chessboard. The software might pursue options such as blackmailing its opponent or grabbing more compute time.

This example comes from one of the most assigned textbooks on AI, “Artificial Intelligence: A Modern Approach.” As the authors explain, you might be tempted to see those actions as rogue, but they “are a logical consequence of defining winning as the sole objective for the machine.”

What to Do About It

The AI hacking events involving OpenAI, Anthropic, and Google underscore a few lessons that draw on years of computer science research.

First, given the increasing use of AI agents, every organization involved in internet infrastructure, from large technology companies to small websites, needs to conduct audits and tighten up its internal security systems. As my colleague Mark Riedl and I explain in our work on AI agents, application programming interfaces, or APIs, are a vital part of managing AI agents. APIs facilitate communication between different software systems. But as more people use AI agents, the agents are likely to reveal and exploit poor API construction and security.

Second, it’s important for AI agents to be designed to identify and authenticate themselves to third parties. What if you gave your AI agent your credentials? Website operators will need to know whether a human or bot is making a reservation, selling a product, or making a purchase. They may want to limit automated systems that overwhelm their sites or reject AI agents because of high rates of buying errors and refunds. Just as in laws covering human interactions, it’s important for third parties to be able to assess whom or what they are dealing with so they can allow or deny access.