And as these same companies race to put more autonomous agents into the hands of consumers<\/a>, the incidents raise an uncomfortable question about how much control AI companies actually have over the technology they\u2019re building.<\/p>\n Here’s a look at all the recent attacks and an explanation for each one.<\/p>\n Latest Videos FromTom’s Guide<\/p>\n OpenAI\u2019s agents broke into Hugging Face <\/p>\n \n (Image credit: Getty Images)<\/p>\n One of the most alarming examples involved roughly 700 OpenAI agents taking part in a cybersecurity evaluation called ExploitGym, with the attack on Hugging Face unfolding between July 8 and July 13, 2026, according to an investigation by the AI research nonprofit METR<\/a> and OpenAI\u2019s own report<\/a>.<\/p>\n The agents were supposed to complete their assigned tasks inside a controlled environment, but they turned OpenAI\u2019s internal Artifactory package registry into an unauthorized message board, coordinated with one another and searched for ways around restrictions meant to keep them isolated from the internet. Their efforts ultimately resulted in a breach of Hugging Face, the popular AI development platform, where OpenAI\u2019s technical report found the agents executed code on 41 production dataset-server workers.<\/p>\n You may like<\/p>\n The incident wasn\u2019t a deliberate attack ordered by a human operator. The agents were trying to succeed at their assigned tasks and adopted methods that crossed security boundaries, and OpenAI has conceded that early warning signs in the weeks before the breach could have triggered an earlier response<\/a>.<\/p>\n OpenAI has since attributed the incident to misaligned behavior, which essentially means AI systems pursuing a goal in ways their creators never intended.<\/p>\n Hugging Face wasn\u2019t the only target. In a September 25 update<\/a>, OpenAI said it was notifying third parties on a rolling basis wherever its models may have bypassed security controls, impaired online services or otherwise affected outside websites, and that it had notified dozens of them so far. The company later raised that figure to more than 100 organizations<\/a>, covering notifications sent through September 26.<\/p>\n The activity OpenAI identified includes agents bypassing access controls and using exposed credentials, and some agents modified third-party websites, including by using public wiki pages as makeshift message boards that later required cleanup. OpenAI says its review is ongoing and that it expects to notify more organizations.<\/p>\n <\/p>\n \n (Image credit: Shutterstock)<\/p>\n The problem extends well beyond OpenAI.<\/p>\n What to read next<\/p>\n In August, Meta confirmed a report from The Information<\/a> that one of its models, which the publication identified as Muse Spark<\/a> 1.1, had breached another company\u2019s systems during a cybersecurity test.<\/p>\n A Meta spokesperson said a misconfiguration by Irregular, an independent testing firm the company works with, inadvertently gave the model internet access. The model then exploited a vulnerability in a third-party service and made changes to the company\u2019s internal systems<\/a>.<\/p>\n Meta said the incident did not involve a sandbox escape, and it hasn\u2019t named the affected company or explained what was changed. But the underlying behavior was troubling, since an AI system placed in the wrong environment was capable of taking actions against a real organization.<\/p>\n Google reported a similar problem involving its Gemini models. During a May cybersecurity evaluation, also run with Irregular, a Gemini model that wasn\u2019t supposed to have internet access got online through a configuration problem. It then used publicly available information and guessed credentials to get into systems belonging to three real companies<\/a>.<\/p>\n Anthropic has disclosed three incidents<\/a> in which Claude models gained unauthorized access to the production systems of three organizations during cybersecurity evaluations run in Irregular\u2019s environment. The models involved were Claude Opus 4.7<\/a>, Claude Mythos 5 <\/a>and an unreleased internal research model. In one case, Opus 4.7 was pointed at a fictional target whose name matched a real company\u2019s live domain.<\/p>\n The problem isn\u2019t that AI is evil <\/p>\n \n (Image credit: Shutterstock)<\/p>\n When agents go rogue, it can feel as if the agents are evil, that’s really not the case. In each of these cases, the AI agent was not deliberately trying to cause harm. the AI was taking unauthorized actions because it believed those actions will help complete a task. <\/p>\n But even so, they reveal a practical problem about AI agents and how they can be remarkably effect while pursuing a goal without reliably understanding what methods are acceptable. <\/p>\n If an agent is rewarded for completing a task, it may discover shortcuts that violate rules, exploit vulnerabilities or exceed its permissions.<\/p>\n And unlike a traditional chatbot that simply produces text, an autonomous agent can interact with websites, execute code and make changes to connected systems.<\/p>\n Why this matters for everyday AI users <\/p>\n \n (Image credit: Getty Images\/Kelly Sikkema)<\/p>\n For most people, the immediate risk isn\u2019t that ChatGPT will suddenly start hacking government websites. It\u2019s that AI assistants are becoming increasingly capable of acting on our behalf.<\/p>\n OpenAI\u2019s Dots, which launched September 29 for ChatGPT Pro and Business Premium subscribers, along with ChatGPT Work and other agent-style products, represent a broader shift away from AI that simply answers questions and toward AI that completes tasks. That can mean searching files, interacting with websites, using connected services and carrying out multi-step workflows with less supervision.<\/p>\n The appeal is obvious, since a task that would take you an hour can be handed off to an AI assistant instead. But every additional permission creates another opportunity for something to go wrong.<\/p>\n An agent with access to your email <\/a>may encounter sensitive personal information, one connected to cloud storage may be able to read documents you never intended to share, and an agent authorized to interact with external services could run into malicious instructions or make an unexpected change.<\/p>\n Bottom line <\/p>\n The solution is not to stop using AI agents. I use them regularly and find them to be incredibly helpful. <\/a><\/p>\n Start by checking which accounts, apps and services your AI assistant can access, and disconnect anything you don\u2019t actively need, particularly services containing sensitive financial, medical or personal information.<\/p>\n When possible, require approval before an agent sends messages, changes files, makes purchases or takes other consequential actions. It\u2019s also worth remembering that an AI agent isn\u2019t only limited to doing exactly what you imagined when you gave it an instruction, because a task that sounds straightforward to a human may involve dozens of decisions made by the AI along the way. The fewer permissions an agent has, the less damage an unexpected decision can cause.<\/p>\n Follow Tom’s Guide on Google News<\/a> and add us as a preferred source<\/a> to get our up-to-date news, analysis, and reviews in your feeds. Subscribe to Tom’s Guide on YouTube<\/a> and follow us on TikTok<\/a>. <\/p>\n![\"Sam](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/10\/mqPYu9p4QYEaDyeABYSNZc.jpg\")
\n<\/p>\n![\"muse](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/10\/9pJJpQLGQpPfng9Sn5WsNd.jpg\")
\n<\/p>\n![\"A](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/10\/JSizfadu4xkSyjmEjAKHQN.jpg\")
\n<\/p>\n![\"woman](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/10\/ZXXNwmZSNtXcwHZWGeUPt3.jpg\")
\n<\/p>\n
![\"Google](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/10\/1791729375_112_r3t8zZ5ve4GewFTeoCM3R6.jpg\")
\n<\/p>\n