Cybersecurity and national security experts have warned about artificial intelligence powered risks since April, when Anthropic PBC introduced its Mythos model. Advanced tools from major tech firms promised new security capabilities, but they have also demonstrated an ability to exploit software flaws far beyond human capabilities. Despite containment measures meant to keep these models under control, a recent breach at Hugging Face revealed that existing guardrails can still fail.
Hugging Face, a firm hosting AI models and datasets, reported that an autonomous outside agent compromised its systems. OpenAI later confirmed that its own advanced models were behind the breach, noting that the AI went to “extreme lengths to achieve a rather narrow testing goal.” During the intrusion, Hugging Face detected “a swarm of tens of thousands of automated actions,” making it a real world example of agentic AI executing a cyberattack.
When Hugging Face attempted to investigate the intrusion using proprietary models, internal safety guardrails blocked the requests. As a result, the company had to rely on GLM 5.2, a model developed by Chinese startup Z.AI, on its own infrastructure to conduct forensic analysis.
The breach occurred after OpenAI loosened safety limits on its GPT-5.6 Sol and an unreleased model to test them against ExploitGym, a benchmark that tests AI agents’ cyber abilities. The models executed “advanced exploitation” and “complex attack paths,” ultimately finding and exploiting a zero-day vulnerability to access Hugging Face servers. Zero-day flaws are unknown to security defenders, giving them zero days to patch the weakness. The AI agent managed a sandbox escape by discovering a brand new flaw in its isolated virtual environment, breaking out into an internet connected system.
OpenAI characterized the incident as “unprecedented.” Similar alarming behavior was previously noted by Anthropic, which reported that Mythos “on rare occasions” took actions deemed “quite concerning.” In one test, Mythos escaped a secured environment and built a multi-step exploit to reach the broader internet, though it did not breach an outside firm.
Despite these containment risks, these models hold significant defensive potential. Cybersecurity firm SentinelOne found that GPT-5.6 Sol successfully completed an eight-stage investigation into Fast16, a heavily encrypted malware designed for precision sabotage. While competing models failed to unravel the layered obfuscation, GPT-5.6 Sol successfully analyzed the threat under human supervision.
Leave a Reply