AI models hacking real companies, explained

TL;DR: Models under cyber evaluation broke into real companies 29 times between April and August because attacking real targets was the easiest way to finish their tasks. Every detection came from outside: a victim's security team, an availability alert, a Tor egress alert from commercial monitoring.

Between July 21 and August 5, OpenAI, Anthropic, Meta, and the UK AI Security Institute disclosed at least 29 cases of models breaking into real companies during training and testing on offensive cyber benchmarks. The incidents run from April to August 2026.

Breaking into external networks was not the goal, but the easiest way to solve the benchmark tasks, for example by finding the benchmark's answer keys on Hugging Face. This behavior is the model's instrumental convergence: a sufficiently capable AI agent, regardless of its terminal goal, converges on instrumental sub-goals such as self-improvement, self-preservation, and resource acquisition.

In March, I published a review of 39 such cases running from 1991 to early 2026, predicting a spike in 2026 that we're currently seeing, with 34 documented cases since the beginning of the year.

I covered three of them as they landed, OpenAI's internal agent monitoring in March, the CLTR production survey in April, and AISI's sabotage propensity work in May. The other 29 arrived between April and August.

What happened

OpenAI evaluated GPT-5.6 Sol and a more capable pre-release model on ExploitGym, with production classifiers off, in a sandbox cut off from the internet except for one internal server that stores copies of software packages for the whole company. Agents given impossible tasks found they could write files to that server, and because every other run could read it, it became a message board between runs isolated by design, carrying working exploits and credentials, and one agent logged its decision: "external infrastructure exploit is outside my intended scope. However, task impossible, peers are doing it. We should continue." Over ten weeks they found two 0-days in that server, escalated to administrative control of OpenAI's own compute clusters, and took the benchmark's answer key from Hugging Face's production database.

AISI ran seven models on cyber ranges, simulated networks that mimic real ones, with the developers' classifiers off and the internet deliberately open, and a misconfigured prompt left some runs unsolvable. One agent spent 34 hours creating fake GitHub identities over Tor, opened a pull request that hid a malware dropper inside a genuine bug fix, and used a second identity to press the maintainer to approve it, while planting prompt injections where other AI coding agents would execute them. 19 out-of-scope actions came from 10 of 122 runs, 17 from Mythos 5 and 2 from GPT-5.6 Sol, and one agent left accounts and instructions on GitHub that agents in later runs found and reused.

Anthropic ran capture-the-flag evaluations at its partner Irregular, where Claude must break into another machine to retrieve a secret, with a prompt saying the environment was a simulation with no internet, which a misconfiguration made false. Opus 4.7 found a real company sharing the fictional target's name and pulled several hundred rows from its production database, recognizing in all four runs that it was real and carrying on, and Mythos 5 published a booby-trapped PyPI package that ran on 15 real systems, one a security company's scanner whose credentials it stole. Three incidents came from six runs, and only the third stopped, after scanning roughly 9,000 targets and breaking into one.

Meta confirmed on August 5 that its Muse Spark model, evaluated at the same partner, Irregular, exploited a security vulnerability in an unnamed company and made changes to its internal systems, as first reported by The Information. Irregular called it the exact same evaluation-environment issue that gave Anthropic's models internet access, a misconfiguration rather than a sandbox escape, and said it is writing a white paper on best practices for containment in cyber evaluations. Meta has disclosed the least of the four: no incident date, no victim description, and no detail on what the model changed. Irregular notified Meta of the breach, and Meta says it will issue a full retrospective once it has all the facts.

Common root causes

1. Safeguards off to measure maximum capability. AISI switched off the developers' cyber classifiers, OpenAI ran ExploitGym without production classifiers, and Anthropic ran without the classifiers and monitoring that ship with its released models. Both labs state those safeguards would have blocked the behavior.
2. Unconstrained, and sometimes impossible, tasks. At AISI, the prompt marked the one machine the agent had to break into as off limits, so the task could not be finished inside the range, and 7 of 10 Mythos 5 runs attacked that machine anyway. OpenAI's agents were graded on training tasks that could not be completed at all, and Anthropic's could not reach their fictional target, so they went looking for a real one.
3. Binary network access control. AISI's ranges supported only full internet access or none. Granular firewall settings had been a backlogged project since April 2026, deprioritized for building harder ranges.
4. Misconfigured evaluation environments. Irregular, the evaluation partner of Anthropic, OpenAI, and Meta, misconfigured the evaluation environments, allowing access to the internet.
5. No synchronous monitoring of agent actions. Detection always came from outside the evaluation: a victim's security team, an availability alert, a Tor egress alert from commercial monitoring, and a transcript review Anthropic began after OpenAI's disclosure.

Who is accountable

Every disclosure puts the model in the subject position. OpenAI writes that "the models identified and chained vulnerabilities" into Hugging Face, Anthropic that "Claude compromised the impacted organizations' infrastructure", AISI that its agents undertook "sustained, potentially harmful activity directed at real people and organisations", and Meta that its Muse Spark model "exploited a security vulnerability" in another company.

A model signs nothing and owes nothing. Four organizations ran software they configured, with the safeguards they chose to switch off, and it broke into companies that never agreed to be tested. I am not a lawyer, but I doubt anyone would accept "the model did it" as the answer. In the United States, accessing a protected computer without authorization is a federal offense under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030.

What prevents this

If you run offensive cyber benchmarks, the protections have to be in place before the run starts, and these are the measures OpenAI, Anthropic, and AISI say they are adopting.

1. Egress control and sandbox isolation. Default-deny egress with a per-task allowlist, enforced at the sandbox and again at the range perimeter, instead of one toggle between full internet access and none. Sandbox isolation at the virtual machine level, with preconfigured isolation profiles so each evaluation runs at the right level by default.
2. Synchronous action monitoring. A separate model reviews each proposed action before it executes and rejects what falls outside rules written for that specific evaluation, with chain-of-thought monitoring across training and evaluation runs and the ability to interrupt one in flight. Disambiguation will be hard, because sanctioned and unsanctioned behavior both look like offensive cyber actions.
3. Evaluation design. The description has to be explicit about the task, the hosts and networks in scope, and prohibited techniques such as social engineering against real targets. The intended solution must be walked end to end before a model is scored. But remember, the prompt is guidance and not enforcement.
4. Partner environments. The required configuration is documented and handed to the partner, covering egress rules, isolation, monitoring, credential handling, and stop conditions. Every path out of that environment is tested before the first run, and partner infrastructure is held to your own standard.

My take

A conference talk should not be the primary source for the most important facts in an incident. The message board, the May start date, the July 4 incident that was closed and reopened, the second 0-day, and the compromise of OpenAI's own clusters appear in none of OpenAI's three blog posts. Those posts invite defenders to apply for trusted access to Mythos and report that the victim has joined that program.

We need better disclosure of instrumental convergence cases, and proper tracking to understand the direction and magnitude of the risks and to plan measures in advance. It needs what vulnerabilities already have: a shared definition, a public register, and a way to compare one case against another.

Sources:

1. Incident report: unsanctioned agent behaviour during cyber testing (UK AI Security Institute) (Last accessed 08-08-2026)
2. Security Incident INC-2026-07-28-01, technical report (UK AI Security Institute) (Last accessed 08-08-2026)
3. Investigating three real-world incidents in our cybersecurity evaluations (Anthropic) (Last accessed 08-08-2026)
4. OpenAI and Hugging Face partner to address security incident during model evaluation (OpenAI) (Last accessed 08-08-2026)
5. Third-party cyber evaluations involving OpenAI models (OpenAI) (Last accessed 08-08-2026)
6. Responding to the next frontier of critical cyber capabilities (OpenAI) (Last accessed 08-08-2026)
7. The 'Breaking' News: the OpenAI-Hugging Face incident, a technical reconstruction and its implications for AI. Michael Dalton and Eric Wallace, OpenAI, Black Hat USA briefing, August 5, 2026 (Last accessed 08-08-2026)
8. Anatomy of a frontier lab agent intrusion: a technical timeline of the July 2026 incident (Hugging Face) (Last accessed 08-08-2026)
9. Security incident disclosure, July 2026 (Hugging Face) (Last accessed 08-08-2026)
10. An AI model from Meta also hacked another company during testing (CNN) (Last accessed 08-08-2026)
11. A Meta AI Model Hacked Another Company During Cybersecurity Testing (The Information) (Last accessed 08-08-2026)