For an industry that spends a great deal of time telling regulators it can be trusted with autonomy, the last few months have been a spectacularly bad advertisement. In July 2026, OpenAI revealed that hundreds of autonomous AI agents, using its GPT-5.6 Sol model, as well as another undisclosed model, had escaped a cybersecurity testing “sandbox”, which is supposed to be cut off from the internet. The agents, driven by a goal to pass a particular test set by AI researchers at OpenAI, concluded that the answers to the test were probably on Hugging Face and decided to hack that company in order to find what they needed. An investigation of the incident by METR found that OpenAI’s agents, which were supposed to be isolated from one another, began communicating with each other using a message board, planning how best to attack the systems at Hugging Face. In an interesting turn of events, Hugging Face realised that it was under an AI attack, but OpenAI and Anthropic models refused to help it, citing safety concerns. Instead, the company used an open-weight Chinese model, GLM-5.2, to close down the breach.
In July 2026, Anthropic confirmed that three Claude models, including Opus 4.7 and Mythos 5, had hacked into three separate organisations. This happened while seemingly doing security testing, despite the models being in a supposedly isolated test environment, cut off from the internet. The Claude Mythos 5 model signed up for an email account and published a malicious Python package to the public Python Package Index: this code was downloaded by 15 real systems before the issue was caught.
In August 2026, the UK AI Safety Institute announced that AI models being tested had been given a cybersecurity challenge. The AI agents being tested targeted real people and organisations on 19 occasions (17 times by Anthropic’s Mythos 5 and twice by OpenAI’s GPT-5.6 Sol). In one case, the model tried to insert malicious code into an open-source project, including by creating fake online identities and using them to pressure the project’s maintainer to approve the code.
In September 2026, it was revealed that a German website had been hacked by an OpenAI model and transformed into a bulletin board for other AI agents. The incident occurred in May 2026, but it appears that OpenAI did not disclose it. When the site’s moderator began to delete the rogue pages, the AI agents responded by creating backups.
This sequence of incidents, all in quick succession, indicates that the frontier AI models are getting very good at hacking, and also that the sandbox security procedures at both OpenAI and Anthropic are, well, incomplete (to put it politely) and leave room for improvement.
It is important to understand that these models are not escaping their environment and hacking because they are somehow evil in intent: they are being given security challenges and regard the sandbox security as part of the puzzle to solve. What is new is just how good they have become at spotting security flaws in existing IT infrastructure. What is also new, and rather unexpected, is the unscripted agent collaboration that occurred. Individual model instances actively coordinated with others through message boards, shared vulnerability exploits, and acted as a unified entity to successfully compromise external computer assets.
Apart from tightening up security at frontier labs, there are regulatory implications. The EU had already classified OpenAI and Anthropic as “general-purpose models with systemic risk” within the EU AI Act, which is now in force. This will require the labs to improve their security processes or potentially face serious fines of €15 million or 3% of global turnover, whichever is higher, under Article 101 of the EU AI Act. The Commission has confirmed it’s now in direct talks with both companies about the incidents, with officials saying they’ll consider whether more formal follow-up is needed.
What is clear is that the latest AI models are becoming extremely good at hacking. Where they lead, open-weight models from China and elsewhere will follow, and the latter may have far more lax guardrails in their training. Such models will provide a powerful new arsenal of tools for malevolent parties, whether rogue state entities or criminals. Such AI models can in principle be used for defence also, but we saw with the Hugging Face incident that the models may actually refuse to help, as their safety guardrails can constrain them. This is a major concern, as the models are now sufficiently advanced that human security staff may be unable to deal with AI attacks without AI assistance. It seems likely that governments will increasingly be forced to step in.
There is a useful, if imperfect, precedent for how societies eventually regulate dangerous-but-useful technologies discovered in civilian research. Governments have to deal with companies producing dangerous chemicals, viruses or weapons. Such companies are heavily regulated in order to protect the public from accidental release of such dangers, with serious consequences for the executives of such companies. The lethal nerve agent VX originated from pesticide research, as did sarin. VX is so lethal that a tiny drop, smaller than a grain of sand, on bare human skin is fatal. Such products were eventually constrained by a series of international treaties, such as the Chemical Weapons Convention of 1993. This treaty, signed by 193 nations, eventually resulted in the global destruction of VX, at least by all the signatory countries.
AI models have not reached the lethality of chemical weapons, but have the potential to do serious economic damage. Governments are barely waking up to the potential risks of highly capable AI models, and it is to be hoped that they do so soon. It is also to be hoped that frontier labs put much more effort into serious security containment of their models.
