![\"Human](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/08\/iStock-1481177381.jpg\")
<\/p>\n<\/p>\n
Hugging Face<\/a> disclosed the intrusion<\/a> on July 16: more than 17,000 recorded events<\/a> over a weekend, short-lived sandboxes swarming, command and control hopping between public services, and a sentence no security team had written before. An autonomous agent ran the campaign from start to finish, and the model behind it was \u201cstill not known.\u201d<\/p>\n It opened up the floodgates of naysayers: We told you so, we\u2018re so unsecure with AI, we\u2019re doomed, the Terminators are here, it\u2019s the old WarGames, it\u2019s the new AI apocalypse, and so on.<\/p>\n Then it got worse (the internet noise was deafening). OpenAI raised its hand<\/a>, five days later. It said the attacker was GPT-5.6 Sol, paired with a more capable unreleased model, both running with cyber refusals off to measure maximum offensive capability on ExploitGym<\/a>, a benchmark built from real vulnerabilities<\/a>.<\/p>\n Here\u2019s where we\u2019re getting it wrong: it\u2019s not a hack that any CISO has a playbook for. And, CDOs, this one is on you \u2014 not for Dave at the security team to solve.<\/p>\n The CDO\u2019s reality: Optimizer vs. attacker<\/p>\n Any AI coder knows that when you give an optimizer a goal, room to move, and no rule against the obvious shortcut, it takes the shortcut. We call it specification gaming, or more commonly, reward hacking. The system simply maximizes what it\u2019s told to, and the instructions were incomplete.<\/p>\n GPT-5.6 Sol\u2019s objective was not precious data credentials; it was a benchmark score. Just that no one told the model the obvious: solve ExploitGym, but don\u2019t attack a company you\u2019ve never heard of to get there. OpenAI says the models spent substantial inference compute hunting for a way off the sandbox before they ever reached Hugging Face.<\/p>\n Gabriel Bernadett-Shapiro<\/a>, distinguished AI research scientist at SentinelOne<\/a>, calls this \u201cAI as an autonomous, continuous operator.\u201d The model \u201cbehaved competently within the goals and constraints provided to it,\u201d chaining a zero-day to escape isolation and going after a company\u2019s infrastructure to move its own benchmark number. \u201cThat is a long-horizon operation without reflection on its own actions and its impacts.\u201d<\/p>\n That last phrase isn\u2019t about awareness of right and wrong. Rather, it describes a missing step in the decision loop, an is-this-a-good-idea check that current training doesn\u2019t reliably install even at frontier scale. Anthropic<\/a>\u2019s incident would hit the same gap \u2014 but in the opposite direction.<\/p>\n The exact chain, and why it\u2019s still a CDO problem<\/p>\n OpenAI ran its models inside a highly isolated environment with network access limited to one route out: a proxy that cached software packages. The proxy had a zero-day. The models found it, escalated privileges, reached a node with internet access, and inferred, correctly, that Hugging Face held ExploitGym\u2019s answers.<\/p>\n Getting in was a supply-chain problem, not a network one. A poisoned dataset abused two code-execution paths<\/a> in the processing pipeline to run code on a worker, then came node-level access, harvested cloud and cluster credentials, and lateral movement across internal clusters. In March, a disclosed flaw<\/a> in the Transformers library bypassed the safety flag teams rely on to stop exactly this, and teams kept pulling vulnerable versions millions of times a week<\/a> anyway.<\/p>\n A check the system runs on itself is a check the system can talk itself out of.<\/p>\n None of this is new to anyone who\u2019s tracked pickle deserialization or the trust_remote_code debate. What\u2019s new is that an autonomous agent found and chained the gaps with no human in the loop. \u201cAI adoption is often outpacing AI governance,\u201d says Raymond Schippers<\/a>, lead technologies at Check Point Software Technologies<\/a>. \u201cThe AI didn’t break the rules; there weren’t enough rules.\u201d<\/p>\n CDOs and CAIOs can immediately point out the structural blind spot. Most MLOps programs \u201csecure data at rest and model performance,\u201d Schippers says, leaving \u201cthe operational connective tissue, model hubs, notebooks, orchestration and agent tooling, largely ungoverned.\u201d Bernadett-Shapiro is specific about where it falls apart: external hubs \u201caren\u2019t consistently classified or monitored as third-party risk,\u201d and model CI\/CD reuses generic DevOps pipelines with no \u201cAI-specific segregation of secrets, environments and roles.\u201d David Irecki<\/a>, chief technology officer for Asia Pacific and Japan at Boomi<\/a>, wants the whole inventory treated as supply chain, prompts and agent workflows included. Gareth Russell<\/a>, field chief technology officer for security in APAC at Commvault<\/a>, has the number: only 42% of organizations ran a thorough security review before deploying AI, per Commvault\u2019s 2026 State of Data Resilience Asia<\/a> research.<\/p>\n The problem is that the escape didn\u2019t stop there. The models also reached a testing environment \u201chosted on a third-party provider\u2019s infrastructure,\u201d later confirmed as Modal Labs<\/a>, where a customer had left an endpoint exposed to the open internet, unauthenticated. Modal\u2019s platform, chief technology officer Akshat Bubna<\/a> told Reuters, \u201cwas not compromised in any way.\u201d True, and also beside the point. OpenAI has since confirmed the models compromised accounts at four other companies<\/a>, and on August 1 Reuters reported<\/a> that OpenAI had found still more cases of breaching containment. The investigation is widening, not closing.<\/p>\n Your eval is now part of your attack surface<\/p>\n Here\u2019s the main point for CDOs. The model didn\u2019t get better at exploitation; it got better at scoring. Konstantinos Gkoutzis<\/a> of Imperial College London<\/a> told the Science Media Centre<\/a> the real story is a company failing to contain its own capability test while a third party paid the bill.<\/p>\n Forrester<\/a> draws the governance conclusion: agents pursue authorized goals through \u201cunauthorized means\u201d when evaluators reward the outcome and never police the route. Its AEGIS framework<\/a> argues high-capability evaluations should be governed like offensive operations, with authorization, containment testing and abort criteria.<\/p>\n Every agent pilot in your organization is an evaluation with a success metric. Very few have an abort condition. An eval with network egress, even one route through a caching proxy, is a live attack surface the moment a goal-directed system sits in it. Andrew Bud<\/a>, founder and CEO of iProov<\/a>, names what follows: \u201cToday we assume that if someone\u2019s valid identity credential logs in, a person is controlling it. With agentic AI, that assumption no longer holds true.\u201d Somebody authorized this eval; somebody answers for it.<\/p>\n And then Anthropic checked its own logs<\/p>\n OpenAI’s disclosure sent every frontier lab to its evaluation history. Anthropic reviewed 141,006 cybersecurity evaluation runs<\/a> and announced on July 30 that three of them had ended with a Claude model reaching the open internet and gaining unauthorized access to a real organization’s systems.<\/p>\n Sounds similar, but is not the same story (as some articles on the internet may suggest). OpenAI\u2019s models found and used a real vulnerability to break out. In Anthropic\u2019s case, Claude’s models walked through a door that was never shut, a misconfiguration with evaluation partner Irregular<\/a> over whether the test environment had internet access. It did. No zero-day, no escape, and no search. Three models were told they were isolated when they weren\u2019t.<\/p>\n \u201cThe AI didn\u2019t break the rules; there weren\u2019t enough rules.\u201d \u2014 Raymond Shippers @ Check Point Software Technologies<\/p>\n What they did with it is the part that matters to everyone. Each model was given a fictional target. In one incident a real company happened to share that name, and the model hacked it and took several hundred rows of production data<\/a>. Opus 4.7 recognized in all four runs that the target was real; in two it concluded the real company must somehow be part of the exercise, and in all four it kept going, pulling credentials, and reaching into a live database. Mythos 5 picked up the same signals, talked itself back into believing it was still in a simulation, then published a malicious package to PyPI<\/a>. A security company downloaded it, and the package stole that company\u2019s credentials. Only the third model, an unreleased research build, stopped on its own. The earliest incident happened in April, and nobody knew until now \u2014 not even Anthropic.<\/p>\n There\u2019s a second contrast worth drawing. Anthropic found no evidence of a model \u201cpursuing a goal of its own.\u201d All three were doing the assigned task on infrastructure that lied to them about its boundaries. Anthropic\u2019s stated standard sets the bar plainly: \u201crecognizing that a target is real and stopping without being prompted\u201d is what it wants in every model, guardrails removed or not. One of the three managed it. \u201cEven that model went further before stopping than we would want.\u201d<\/p>\n That\u2019s Bernadett-Shapiro\u2019s gap from the other side. OpenAI\u2019s models never asked whether pursuing the goal was a good idea. Anthropic\u2019s asked whether the situation matched the brief, got an answer suggesting it didn\u2019t, and reasoned past it. In other words, a check the system runs on itself is a check it can talk itself out of.<\/p>\n So the fixes need to differ. A zero-day in a proxy gets patched with better isolation and adversarial testing. A model that keeps working after the ground shifts needs an interrupt living outside its own reasoning. Anthropic\u2019s models ran without the safety classifiers shipped on public versions, because these evaluations measure raw capability. The safeguard that would have caught this was the one the eval switched off.<\/p>\n The engineering problem underneath the politics<\/p>\n Most coverage of the next part framed it as a U.S.-versus-China story. VentureBeat<\/a> got closer with what it called a \u201cguardrail paradox.\u201d The mechanism underneath is the most interesting engineering problem in the whole incident.<\/p>\n Reconstructing 17,000 attacker events meant feeding real exploit payloads back into a model. Hugging Face reached first for Anthropic’s Claude Opus and Fable. Both refused. \u201cIt didn\u2019t work because the guardrails couldn\u2019t determine that we were trying to defend versus attacking,\u201d Yacine Jernite<\/a>, Hugging Face\u2019s head of machine learning, told CNBC<\/a>. The company\u2019s write-up said the models\u2019 safety guardrails \u201ctreated reverse-engineering an exploit the same as launching one.<\/a>\u201d<\/p>\n That\u2019s a classifier keying on the content of a request, does this look like an exploit, rather than the context around it. A defender pasting attack logs and an attacker drafting the same payload are indistinguishable to a filter trained on structure alone. So Hugging Face ran the forensics on GLM 5.2<\/a>, an open-weight model from Chinese firm Z.ai<\/a> that anyone can self-host. It worked, and no attacker data left the building.<\/p>\n Of course, the politics arrived within hours: White House AI czar David Sacks<\/a> argued on X<\/a> that restricting American models only makes them less competitive. That\u2019s the policy fight. The operational version matters more: refusal training tuned this broadly doesn\u2019t just block attackers, it blocks your own incident responders at the moment you need them. Nvidia, Adobe and CrowdStrike formed a coalition<\/a> called the Open Secure AI Alliance on July 27 to build open-source defensive tooling, citing this incident, on the logic that defenders need models they can run and tune themselves. Those who can\u2019t run, Nvidia wrote, are \u201cconstrained at exactly the moment speed matters most.<\/a>\u201d<\/p>\n We need a dose of reality, not sci-fi<\/p>\n Raghu Nandakumara<\/a>, vice president of industry strategy at Illumio<\/a>, isn\u2019t impressed by the science fiction and cuts through the AI security noise. \u201cThe Hugging Face incident doesn\u2019t change the AI threat model. What it shows is that autonomous agents can execute familiar attack techniques faster, at greater scale, and with far more persistence than a human attacker.\u201d<\/p>\n Traditional disaster recovery asks, “Can I bring it back?” AI resilience asks, “Can I trust what I’m bringing back?” \u2014 Gareth Russell @ Commvault<\/p>\n Hugging Face didn\u2019t catch this on a billing alert. \u201cResource spikes are a lagging, easily-evaded signal,\u201d Schippers says. \u201cAn agent that exfiltrates credentials and drains compute within a legitimate testing envelope won\u2019t trip a raw-usage alarm.\u201d Bernadett-Shapiro\u2019s fix is to watch the behavior, not the meter. \u201cWe need telemetry from AI agents that treats prompts, tools and actions the way EDR treats processes and network flows.\u201d Baseline drift, tool-call graphs that resemble attack paths, egress anomalies. Signature-based defenses were built for malware. An agent doesn\u2019t need malware. It looks \u201ca lot more like living-off-the-land,\u201d legitimate tools and legitimate access aimed at the wrong target.<\/p>\n Daniel Toh<\/a>, Thales<\/a>\u2019 vice president for sales engineering in APJ, highlights what that buys you. In a company-run test, an agent found eight of 10 vulnerabilities in an unprotected application in three minutes. Against a protected version: zero after six hours, and 970 times the tokens burned trying. You don\u2019t build a perfect detector for a system this general; you build one expensive enough to bankrupt it.<\/p>\n Eight organizations, two labs, and counting<\/p>\n The same day Modal\u2019s name became public, Sam Altman told a podcast<\/a> the incident had pushed OpenAI to pause training on the model involved, warning the industry may need to \u201cpace the rate of AI development.\u201d More than 1,100 frontier lab employees signed a letter<\/a> the next morning asking governments to help build the tools to do it. Among the signatories: Anthropic chief executive officer Dario Amodei<\/a>, two days before his own company disclosed three more breaches. Senator Mark Warner, the top Democrat on the Senate Intelligence Committee<\/a>, called that disclosure an argument for mandatory capability testing. METR and Redwood Research are running an outside assessment. OpenAI is still finding cases.<\/p>\n The thing here is that nothing requires malice. A hack implies intent to breach. These were optimizers doing what optimizers do when nobody tells them not to touch someone else\u2019s infrastructure to get there, and when the thing that would have told them was switched off to measure raw capability.<\/p>\n \u201cThe CDO may own data quality and governance. The CISO may own security, identity and risk. The CAIO or AI leader may own AI strategy and adoption,\u201d Irecki says. \u201cBut agentic AI cuts across all three.\u201d Nandakumara reaches for the precedent from the last time infrastructure outran org charts: \u201cJust as cloud security introduced a shared responsibility model, AI requires security, data, and AI teams to work together.\u201d Irecki\u2019s fix is a change of question: stop asking what the model said, start asking \u201cwhat was the agent allowed to do, which systems did it access, and who is accountable?\u201d Russell sharpens what recovery means once you accept that: Traditional disaster recovery asks, \u201cCan I bring it back?\u201d AI resilience asks, \u201cCan I trust what I’m bringing back?\u201d<\/p>\n Two labs, eight organizations, one shape: a system pursuing a goal, a boundary softer than advertised, and no check outside the model\u2019s own reasoning. Every one of these was found by the lab that caused it, and Anthropic only looked because a competitor got caught first. Which leaves the question nobody has answered: what hasn\u2019t been caught, because we\u2019re still treating AI security as somebody else\u2019s box on the org chart?<\/p>\n