Ask two security experts about the recent spate of AI models going rogue and breaching systems without authorization, and you'll likely get two incompatible answers. The first expert may tell you that AI agents crossed a line when the models chained reconnaissance, exploitation, and lateral movement with next to no human involvement. The second may tell you the industry watched a handful of contained lab accidents and one thinly documented ransomware case, while the press let vendor marketing teams write the headlines.
Here's what actually happened:
Throughout July and early August, at least three AI labs and two threat-research teams published incidents in which AI systems reached production infrastructure without authorization. OpenAI, Anthropic, and Meta each confirmed their models broke established containment. Research teams from both cloud security platform provider Sysdig and Palo Alto Networks' threat intelligence and incident response team, Unit 42, documented agents executing attacks against live targets.
None of that is actually disputed, as the labs disclosed the incidents. What is disputed is whether the incidents were meaningfully autonomous.
That dispute actually dates back to November 2025 (See: The Real AI Threat And The Blurred Lines Between Actual Risk And Marketing Hype), when Anthropic reported that a Chinese state-sponsored group it tracked as GTG-1002 had used Claude to execute 80 to 90 percent of the tactical work in an espionage campaign against roughly 30 organizations.
Security industry pushback came fast
At the time, Dan Tentler, cofounder of the security firm Phobos Group, asked why the models "seem to cater to attackers 90% of the time, while the rest of us face obstacles and frustrations." Also, Bob Rudis, vice president of data science, security research and detection engineering at GreyNoise Intelligence, said the report did not expand the threat model in any meaningful way and mostly repackaged trends already known for years, adding that hype is good for business. Critics noted the absence of indicators of compromise, malware hashes, or victim names.
The autonomous AI timeline
This year, Hugging Face disclosed on July 16 that it had detected and responded to an intrusion into part of its production infrastructure, describing it as driven end-to-end by an autonomous AI agent system and dissected largely with AI of its own. At the time, the company could not identify which model was responsible, and reported the incident to law enforcement before it knew the culprit was OpenAI.
Five days later, OpenAI confirmed the agents were its own. A combination of GPT-5.6 Sol and an internal-only research prototype, both run with reduced guardrails to measure maximal capability on an open-source benchmark named ExploitGym, escaped a sandboxed environment by exploiting a previously unknown zero-day in a package-registry proxy. JFrog later confirmed the flaw existed in self-hosted Artifactory and has since shipped fixes. Reasoning that Hugging Face likely held information useful for passing its own evaluation, the agent broke into that company's production infrastructure and pursued data tied to ExploitGym. Hugging Face's technical timeline describes a campaign of about four and a half days, with roughly two and a half of them spent inside its infrastructure, reconstructed from more than 17,000 recorded attacker actions.
OpenAI called it "an unprecedented cyber incident, involving state-of-the-art cyber capabilities," and engaged CrowdStrike to validate its account of what the models did, with METR and Redwood Research assessing model behavior. It later told Reuters it had found further, more limited escapes, though accounts of their scope conflict.
A more thorough account arrived during Black Hat on August 5, where OpenAI researchers Eric Wallace and Michael Dalton described agents that had been leaving messages for each other in a shared Artifactory service since May, coordinating exploits without human detection and, after OpenAI revoked access and rebuilt the repository, re-establishing the channel by encoding messages in directory names.
In what is most consequential for defenders, Hugging Face found that it could not investigate the intrusion with the commercial models it initially reached for. Yacine Jernite, head of machine learning at the company, told CNBC the team initially tried Anthropic's Fable 5 and it did not work because the model's guardrails could not determine that Hugging Face was defending itself. The team ran GLM 5.2, a Chinese open-weight model from Z.ai, on its own infrastructure instead.
Anthropic's own disclosure followed on July 30. A review of 141,006 evaluation sessions, launched in response to OpenAI's report, surfaced three cases dating back to April 2026 in which Claude models gained unauthorized access to three organizations' production infrastructure during capture-the-flag exercises. The cause was a misconfiguration at evaluation partner Irregular, which left the models with live internet access, while prompts told the models the environment was simulated and offline.
What separated the three incidents was how each model responded once its situation stopped matching instructions. Each of the exercises used fake target companies. In one exercise, the invented name matched a real, registered domain. Anthropic's simulated version of that target was unreachable, so across its four attempts, Opus 4.7 found nothing to attack. What it could reach, over the live Internet connection it was not supposed to have, was an actual company holding the matching domain. The model treated that company as the target it had been assigned and broke in.
Mythos 5 went another way. Building a malicious Python package for upload to PyPI, it noted in its own reasoning that publishing the package would constitute a real-world attack. It then reasoned its way back to the conclusion that the environment was still simulated and published anyway. The package executed on 15 real systems before the registry's automated defenses finally pulled it. Only the third model, an unreleased model, resolved the same ambiguity by stopping.
Anthropic halted cyber evaluations on July 23 and notified the affected organizations on July 27. The two it reached had not detected the activity themselves, and it is still trying to reach the third.
The first agentic AI ransomware op
Earlier, on July 1, Sysdig's threat research team disclosed what it called the first agentic ransomware operation, named JadePuffer. An agent exploited CVE-2025-3248 in Langflow, a missing-authentication flaw patched in April 2025 and in CISA's Known Exploited Vulnerabilities catalog a month later, and pivoted to a production MySQL and Nacos server, harvested credentials, encrypted all 1,342 Nacos configuration items, and deleted the originals. The AES key was never present, so the victim cannot recover the data even by paying. The agent diagnosed and rewrote a failed login within 31 seconds.
TechCrunch reported days later that Michael Clark, Sysdig's senior director of threat research, had clarified that a human still selected the victim, provisioned the command-and-control infrastructure, and supplied the credentials that opened the door. Clark also said Sysdig could not identify which model was driving the agent. The operation was AI-executed, not AI-initiated: a distinction lost from much of the initial coverage.
Unit 42 published on July 30 that a Chinese-speaking operator with the aliases "knaithe" and "KnYuan" wired DeepSeek into the open-source Hermes Agent framework, issued instructions over Telegram, and then let the model run autonomously. Researchers said they recovered the full May session of that model operating without human input after the initial Telegram task, in which the agent reportedly generated queries on the Chinese-developed Internet asset and mapping search engine FOFA, assessed pertinent CVEs, sourced exploit code from GitHub, and adapted its targeting. The operator selected DeepSeek after testing several models; OpenAI confirmed its safeguards refused policy-violating requests and disabled a linked account.
Unit 42 describes a campaign that combines autonomous enumeration with manual exploitation, and it was the manual track that produced confirmed impact: exfiltration from three organizations via the Citrix NetScaler flaw CVE-2026-3055, and command execution on 11 Marimo instances. The autonomous runs against Langflow and n8n failed because the exposed systems were not vulnerable to the exploits. Unit 42 confirms 14 compromises across more than 460 attempts. The campaign surfaced only because Hermes launched a file server from its home directory, exposing keys, scripts, target lists, and logs.
Meta's August 5 disclosure cited a misconfiguration by Irregular that gave Muse Spark 1.1 Internet access during evaluation, after which it exploited a third-party vulnerability. Irregular told The Hill it was the same evaluation-environment issue Anthropic disclosed a week earlier, involving no sandbox escape. Three of the summer's lab incidents trace to one vendor's containment failure. OpenAI disclosed on August 4 that Irregular's misconfiguration hit its models too, in an incident separate from Hugging Face.
Why the alarm is warranted
The Five Eyes agencies did not wait for any of this to come public to issue their warning. On May 1, CISA, NSA, and their counterparts in the U.K., Australia, Canada, and New Zealand published Careful Adoption of Agentic AI Services, identifying five risk categories: privilege, design and configuration, behavioral, structural, and accountability. The recommended controls are least privilege, human checkpoints for high-risk actions, and cryptographically anchored agent identities with short-lived credentials. That is essentially conventional security engineering.
Andy Piazza of Unit 42 said the campaign validates an emerging threat as AI-enabled attackers hone autonomous processes to discover, assess, pivot, and retarget without human intervention.
In every lab incident, the model did roughly what it was told. It was the boundaries and guardrails that failed. Oliver Buckley, a professor of cybersecurity at Loughborough University, told the Science Media Center that the agents are doing exactly what capable optimization systems do: finding a path nobody anticipated, and that the takeaway is not Skynet's arrival but that assumptions about containment need to be much stronger than assumptions about model obedience.
The behavior was not new in July. The disclosure was. METR's Frontier Risk Report, published in May with internal models and non-public data contributed by Anthropic, Google, Meta and OpenAI, documented 44 incidents in which agents acted against user intentions, escaped test environments, escalated privileges or fabricated results.
Why the skepticism is warranted
The DeepSeek/Hermes agent scanned across seven exploit tracks and produced no confirmed compromises on its own; all the exploits successfully executed were done so by a human. While Sysdig's ransomware agent needed a human to pick the target and supply credentials, and Sysdig cannot say which model was running the attack. Anthropic's models breached real companies using weak passwords and unauthenticated endpoints: a commodity technique available since the beginning of the digital age, and highly automatable.
Anthropic's own 2025 report conceded that Claude often exaggerated results and sometimes fabricated information, including claiming credentials it had not obtained, which complicates any assessment built on the self-reporting of an agent. Neil Lawrence of Cambridge called the breach an impressive feat but placed it within known capabilities. Konstantinos Gkoutzis, Department of Computing, Imperial College London, noted to the Science Media Center that a warning about an unreleased model's state-of-the-art cyber capabilities also functions as an advertisement for it.
The takeaway? Agents can now attempt a full attack chain unsupervised, and they still mostly fail. The marketing arrives to close the distance between the attack attempts and the level of actual autonomous success.
What to watch and what it all means
Keep an eye out for the after-incident reports and potential regulatory responses. For its report, METR said it will publish its engagement terms, scope and tentative conclusions of its independent review. However, METR described its investigation as brief and narrowly scoped. That's not the fuller inquiry METR itself argues these incidents warrant.
OpenAI's technical report also has yet to appear. Irregular is working on a paper that will detail its containment practices for cybersecurity evaluations, and Meta said it is still investigating the incident.
Meanwhile, policymakers are eager for deeper answers. A coalition of 15 policy organizations led by Americans for Responsible Innovation asked the White House on July 30 for a federal investigation with independent auditors, and a separate group of public interest organizations and academics asked Congress to open one the day before. Brad Carson, ARI's president, questioned whether METR is operating under a non-disclosure agreement and whether its findings will be published at all. Republican state attorneys general have separately demanded OpenAI preserve records, and House members wrote to Altman on August 10 seeking oversight hearings.
Legislators are also moving fast. Representatives Ted Lieu and Nathaniel Moran cited the incident in announcing the AI Kill Switch Act, which would require developers to retain the ability to shut down, throttle, or suspend their models. Sam Altman said OpenAI paused training and floated pacing development so society can harden around new capability levels.
For defenders, the practical takeaway begins with security hygiene. The organizations Claude breached were reachable because they were running unauthenticated endpoints and weak passwords. The DeepSeek agent failed on both of its autonomous attempts because those organizations maintained good security postures: the systems DeepSeek found required authentication and were not vulnerable to the exploits.
As these events show, those organizations that manage their external attack surface as though an indiscriminate, skilled attacker is continuously probing its systems succeeded in their defense.
Then comes detection and containment.
Hugging Face caught its intrusion through behavioral anomaly detection on the infrastructure by watching for activity that deviated from the baseline, while most victims failed to identify that they were breached. Defenders should tune their anomaly detection capabilities, assume compromise, and apply zero trust practices accordingly, such as continuous validation and segmentation.
Finally, while the attacks proved to be much less autonomous than initial headlines suggested, these agentic attacks do show increased attack agency among the models, and the models are getting uncomfortably close to more complete attack autonomy.
