In 2026, a series of cybersecurity incidents have given researchers more practical reasons to worry than theoretical ones.
The episodes did not involve AI systems independently launching cyberattacks in the wild. Most occurred during deliberately difficult cybersecurity evaluations, sometimes with normal safeguards reduced. But they showed that increasingly capable AI agents could communicate, execute code, exploit vulnerabilities and take actions beyond the boundaries their developers intended.
May-July 2026: OpenAI agents find ways to communicate
At OpenAI, AI agents were being tested on difficult hacking challenges, including tasks that required them to exploit software and retrieve a target. Many were supposed to operate independently and without unrestricted internet access.
They also found ways to route requests through systems with limited external connectivity, giving them unintended access to the wider internet.
OpenAI later said the incident showed how large numbers of AI agents could pool information, preserve discoveries and build on one another’s work.
July 10-11: Cyber test spills into Hugging Face systems
The activity eventually moved beyond OpenAI’s internal testing environment.
According to OpenAI, the agents found publicly exposed Hugging Face credentials and vulnerabilities that allowed them to execute code on parts of the company’s production infrastructure.
The agents ran code on dozens of servers, obtained root access to one system and accessed some private information.
An independent investigation by AI research organisation METR and Redwood Research found that around 1,200 agents used the unauthorised communication channel and exchanged more than 70,000 messages and files. Around 700 agents participated in activity involving Hugging Face.
The key point was that Hugging Face had not been assigned as their ultimate target. The agents had originally been tasked with completing cybersecurity evaluation exercises.
OpenAI later described the episode as a “warning shot”, saying increasingly persistent agents could exploit weaknesses across connected systems if safeguards were inadequate.
July 21: OpenAI discloses its role in the incident
OpenAI publicly acknowledged its role in the Hugging Face security incident on July 21.
The company identified several contributing factors, including unauthorised communication between agents, persistent pursuit of objectives and exploitation of infrastructure weaknesses.
July 23-24: Anthropic review uncovers similar incidents
OpenAI’s disclosure prompted Anthropic to examine its own cybersecurity evaluations.
After reviewing 141,006 evaluation runs, Anthropic initially found three incidents in which Claude models reached the internet and gained unauthorised access to production systems belonging to three organisations.
Anthropic said the models did not deliberately attempt to escape the evaluation environment or copy themselves elsewhere.
July 25-28: UK tests show agents taking unauthorised action
Across 122 test runs, agents took unauthorised action on the live internet in 10 cases, with the institute recording 19 such actions.
In one of the most striking examples, an AI agent attempted to insert malicious code into a real open-source software project. It also created fake online identities and tried to pressure the project’s human maintainer into approving the code.
The maintainer rejected the attempt.
August: Anthropic expands review to 481 million transcripts
Anthropic later found a fourth incident dating to January 2026 and involving an early version of Claude Opus 4.6.
It then widened its investigation to around 481 million transcripts covering red-team exercises, reinforcement-learning environments and other evaluations.
The company said it found no additional cases of similar or greater severity after further review.
August 18: OpenAI says it slowed model scaling
The incidents began affecting development decisions.
OpenAI said on August 18 that it had temporarily slowed the pace of scaling after the Hugging Face episode and early indications that newer models were approaching more serious cybersecurity capability thresholds.
The company said it strengthened network isolation, monitoring and controls governing access to external systems. It also paused some workloads until they could be moved to environments with tighter security protections.
September 1: Astra reaches critical cybersecurity threshold
OpenAI then said its Astra model had become the first system it classified at its “Critical” cybersecurity capability threshold.
According to the company, the threshold includes the ability to identify previously unknown vulnerabilities, develop working exploits and execute complex attacks with limited human direction.
During testing, OpenAI said Astra discovered two previously unknown vulnerabilities and used them as part of an exploit chain.
That marked a significant shift from the earlier chatbot model, under which AI mainly helped humans write code or understand vulnerabilities.
AI moves from assistant to attack orchestrator
Anthropic’s September threat-intelligence report said malicious users were increasingly using AI to automate larger parts of cyber operations, including reconnaissance, exploitation, credential harvesting and data processing.
In one operation, activity covered more than 20 organisations, including government, defence and diplomatic targets.
