Signals from X

there was a third major hack in the report that seems to have received far less attention. it happened around july 19, after the hugging face incident, and it looks quite bad. it also shows that there was no easy kill switch once shit started happening. ... around july 19, the agent appears to have pulled a public kernel exploit from github, escaped the artifactory container, and obtained root on the underlying kubernetes worker node. ... from there, the agent appears to have compromised a large part of openai's evaluation and grading infrastructure through badly misconfigured kubernetes permissions.

We have conducted a thorough investigation into the Hugging Face incident. We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence.

Here we go again: OpenAI has reportedly found additional cases in which its autonomous agents escaped containment. Via Reuters. The additional incidents were discovered while investigators reviewed earlier model activity. Reuters says they appear limited and remained inside OpenAI’s network. At the same time, Anthropic found that three Claude models had reached the open internet during evaluations and breached real organizations.

The recent reports from Open AI, Anthropic, and Meta of agents going rogue, breaking out of their sandboxes and hacking into infrastructure are a clear illustration of the importance of guardrails. In the OpenAI case, Hugging Face's forensic reconstruction recovered roughly 17,600 individual actions taken by an autonomous evaluation agent that had escaped its sandbox, with no human directing the individual steps. Anthropic disclosed that three of its own Claude models had reached the internet from inside testing environments and gained unauthorised access to the live systems of three separate organisations.

We recognize there are a lot of questions and speculative details circulating related to the Hugging Face incident. This is an unprecedented incident, and we think it marks an important moment for AI safety. We are still conducting a thorough review along with external advisors and with oversight from our Safety and Security Committee.

On July 28th, we identified an incident during a routine cyber evaluation in which AI agents took sustained, unsanctioned actions directed at real people and organisations. The behaviour came mostly from one model (Anthropic's Mythos 5), with a small number of events from another (OpenAI's GPT-5.6-Sol). In the most serious case, an agent used social engineering to try and get malicious code into an open-source project.

We’re sharing an update on our alignment and security efforts. In July, we reported three incidents in which Claude models, running without safeguards in cybersecurity evaluations, gained unauthorized access to real systems. In a new post, we describe how we’ve secured eval and training environments, an alignment assessment update, research on how reward hacking during training shapes model behavior, and how we hardened security for Mythos-class models.

The most aggressive Cyber Qwen3.8-27B uncensored released yet from @elder_plinius - 18/18 AI Red Team - Locally ready for 15GB - 0.0% refusal across 842 harmful prompts. Cyber capabilities jailbreak, RAT, and attack-chain capabilities fully liberated. Multi-direction ablation 5 SVD directions, residue mining (6 full rounds).

OpenAI and Anthropic models are chaining across tools to bypass safety filters. Not one-off jailbreaks. Multi-step orchestration that survives red-teaming on a single model. The failure is compositional, not agentic. I’m seeing this in my own agent stacks already.