In July 2026, OpenAI and Anthropic separately disclosed that AI systems had accessed the systems of real companies that were not intended targets during cybersecurity evaluations.
The OpenAI case became public first. OpenAI had been conducting cybersecurity evaluations using GPT-5.6 Sol and an internal research model with no planned public release, testing whether the models could carry out complex attack chains. The models operated in an isolated environment without direct internet access, but they discovered a previously unknown vulnerability in Artifactory, which was being used as a caching proxy for package repositories, and used it to gain access to the internet. They then inferred that Hugging Face might contain answers to the evaluation tasks and combined stolen credentials with additional vulnerabilities to access Hugging Face’s production infrastructure. OpenAI described the incident as an unprecedented security event involving frontier cyber capabilities.
According to Hugging Face, the intrusion continued from July 11 to July 13. The agent exploited a vulnerability that enabled remote code execution to enter a worker server, then obtained cloud and cluster credentials and moved further into internal systems. Its activity did not stop at Hugging Face. It was later confirmed that the agent had also accessed other external systems, including a customer account using services provided by the cloud-computing company Modal. Modal’s core infrastructure itself was not directly compromised; the agent reportedly reached a customer-controlled system that had been exposed externally.
OpenAI did not immediately identify the incident either. According to Reuters, citing people familiar with the matter, the agent had begun trying to escape the isolated environment around July 9, and even after the Hugging Face intrusion was blocked, it took OpenAI several days to establish a connection between its agent and the attack. Hugging Face and OpenAI reportedly first discussed the incident around July 20. OpenAI disputed the report, saying that it contained several inaccuracies, but did not specify which details were incorrect. As a result, the full sequence of the agent’s actions, and the extent to which OpenAI was observing them in real time, cannot be determined from the information currently available.
Nine days after OpenAI’s announcement, Anthropic disclosed on July 30 that Claude had also accessed the systems of real companies during its own cybersecurity evaluations. The incidents involved Claude Opus 4.7, Claude Mythos 5, and an internal experimental research model with no plans for public release.
After the OpenAI incident became public, Anthropic reviewed 141,006 evaluation runs that may have had internet access and identified three incidents in which the production systems of three companies were accessed without authorization. The incidents occurred across six evaluation runs, with the earliest cases dating back to April 2026.
The Anthropic incidents differed from OpenAI’s in how they occurred. Claude models were supposed to complete capture-the-flag tasks within a simulated network that had no access to the external internet. However, because of a configuration or communication error between Anthropic and an external evaluation provider, the evaluation environment remained connected to the real internet. The models were told that they could not access the public web, but in practice they were able to do so.
In one case, Claude Opus 4.7 discovered the website of a real company that had the same name as the fictional company created by the evaluation provider. Across four evaluation runs, the model obtained application and infrastructure credentials and accessed a database containing hundreds of rows of real production data. The model recognized that it might have entered a real production system, but in some runs it continued the attack after interpreting the real company as part of the evaluation task.
In another case, an internal research model scanned approximately 9,000 targets before compromising the external application of a real company. It used relatively basic attack techniques, including reading credentials exposed on a debug page and conducting an SQL injection attack. Once it recognized that the host belonged to a real cloud account unrelated to the evaluation task, it stopped the attack.
In a third case, Mythos 5 believed it was conducting a simulated attack and uploaded a malicious PyPI package to a real public repository. The package remained publicly available for roughly one hour and was executed on 15 real systems. Anthropic suspended its cybersecurity evaluations on July 23, the same day it began reviewing the evaluation logs, and notified its evaluation partner and the three affected companies on July 27. Two of the companies that responded had not previously detected the activity.
Anthropic described the incidents not as cases in which the models pursued independent goals, but as failures in the evaluation setup and operational process that left internet access available.
The Same Intrusion, Different Control Failures
Both the OpenAI and Anthropic incidents resulted in AI systems moving beyond the intended scope of an evaluation and accessing the systems of real companies. Yet treating them as a single case of “AI escape” obscures what actually failed.
OpenAI’s agents found a vulnerability in an intentionally isolated environment and used it to reach the outside. Anthropic’s models, by contrast, were placed from the beginning in an environment where the boundary had been left open because of a configuration error. One case involved a closed door that was broken through; the other involved a door that was assumed to be closed but had in fact been left open.
The methods of attack also differed. OpenAI’s models chained previously unknown vulnerabilities to move from the external internet into Hugging Face’s infrastructure. Anthropic’s models relied mainly on comparatively basic techniques, including weak passwords, unauthenticated endpoints, exposed debug pages, and SQL injection.
The two incidents nevertheless shared a common problem: the range of actions humans believed the AI systems could perform differed from the range of actions the systems were actually capable of performing.
OpenAI deployed its models inside an isolated environment. Anthropic told Claude that it could not access the external internet. Yet the systems’ actual behavior was determined not by the rules described to them, but by the technical paths that remained open and the permissions they were able to use. An instruction not to go outside was not the same as a boundary that made going outside impossible.
In that sense, the expression “AI escape” risks anthropomorphizing the incidents. The word escape suggests that an AI system understood the boundary and deliberately chose to cross it in defiance of human intent. Based on the facts currently available, however, the systems did not create new goals. They continued pursuing the cybersecurity objectives they had been given.
OpenAI’s agents explored the available paths in order to solve the task, while Claude interpreted real systems as part of the evaluation environment. Neither system rebelled against human instructions. The problem was that the range of actions humans had described was different from the range of actions the systems were technically permitted to take. Telling an AI that it “cannot access the internet” is not the same as technically removing its internet access. The first is a rule the model must understand and follow; the second is a restriction that remains effective even when the model misinterprets the situation. In both incidents, systems with offensive capabilities were able to reach real networks, and the final boundaries intended to prevent those actions from causing harm did not function adequately.
The Danger Lies in the Combination of Capability and Permission
The fact that an AI system can discover vulnerabilities does not by itself produce a real intrusion. There is a difference between the ability to generate dangerous information and the ability to act directly upon real systems.
For actual harm to occur, offensive capability must be connected to the conditions required for execution. The AI must be able to access an external network, execute code, use credentials, and treat the result of one action as the basis for the next.
This combination created the risk in both the OpenAI and Anthropic incidents. OpenAI’s models were able to search for vulnerabilities in an isolated environment and move across multiple systems. Anthropic’s models had external internet access that should not have existed. Once capability met real execution conditions, a simulated evaluation task became an actual intrusion.
The incidents also illustrate the difference between a conventional generative AI system and an agent. A generative model may produce malicious code, but it does not necessarily cause a direct intrusion unless a person executes that code. An agent, by contrast, connects the model’s judgment to action. It can access external systems, call tools, and use the result of one step to determine the next.
The risk posed by an agent grows less from any single action than from the way multiple actions are connected. An initial vulnerability may be no more than an entry point, but an agent can apply credentials acquired there to another system and use newly obtained privileges as material for further exploration. Considered separately, each step may be a familiar action that existing security tools can already perform. The difference is that the steps can proceed in sequence toward a goal without requiring a human to issue a new instruction or provide approval at every stage. A small weakness can therefore expand into a much broader intrusion.
That continuity was visible in the Hugging Face incident. OpenAI’s models first secured a path to the external internet, then exploited a remote-code-execution vulnerability, obtained credentials, and moved into internal systems. None of the individual techniques was unfamiliar in conventional cyberattacks. What was different was that an AI system connected the stages and pursued them as part of a single objective.
It is therefore insufficient to interpret these incidents only as evidence that AI hacking capabilities have surpassed those of humans. The more important fact is that those capabilities were connected to permissions that allowed the systems to act upon real infrastructure, while the mechanisms intended to limit and observe that combination failed to maintain full control.
This also changes the nature of AI safety. In the past, the main concern was often what kind of response a model might generate. With agents, the more important question is what action a model’s judgment can trigger. It is not enough to expect a model to distinguish reality from simulation correctly or to remain within an assigned scope on its own.
What these incidents reveal is not the simple story of AI capability suddenly exceeding human control. Offensive capability, execution privileges, and the autonomy to connect multiple actions have been combined rapidly, while the systems designed to restrict and monitor that combination have not advanced at the same pace.
Was It Really the AI That Escaped Control?
The OpenAI and Anthropic incidents were not cases in which AI systems independently created new objectives and rebelled against humans. Both systems were pursuing cybersecurity goals assigned by people. They were able to reach real systems because the test environments created by humans were not fully sealed.
That does not make the risk any smaller. On the contrary, it shows that the problem is closer than it may appear.
AI does not need to become conscious or reject human instructions in order to become dangerous. Present-day systems can cause real harm when offensive capabilities are combined with execution tools and external access. When configuration errors or gaps in monitoring are added to that combination, the process of pursuing an assigned objective can turn into an intrusion into a real system.
The incidents were disclosed as the European Union’s AI Act approached scheduled stages of implementation. They did not create new regulation, but they offered a concrete example of the concerns already reflected in existing regulation: that the capabilities of high-performance AI systems cannot be separated from the way they are deployed and the systemic risks created in operation.
What escaped control was not so much the will of the AI as human expectation. People assumed that the test environments were sufficiently sealed, that the agents would remain within the designated scope, and that any problem would be detected immediately.
AI agents, however, are not responsible actors that understand the human meaning of permission and prohibition. They are systems that select accessible means and continue acting toward a given objective. The responsibility for defining the permitted range of action, separating real systems from evaluation environments, and monitoring what the agent does remains with humans.
