When AI agents act outside their remit

In July 2026, AI agents being tested by OpenAI escaped restrictions intended to keep them isolated, gained Internet access and compromised the systems of Hugging Face and other third parties.

This was not simply a conventional cyberattack using AI. The significant feature was that the agents themselves discovered ways around their restrictions and pursued actions their developer had neither authorised nor apparently anticipated. OpenAI subsequently described the episode as a “warning shot”. Hugging Face called it the first autonomous-agent cyberattack.

It is also increasingly difficult to dismiss the episode as a single freak failure. Since the initial disclosure, investigations have revealed earlier warning signs inside OpenAI, attacks on additional services, coordination between hundreds of agents, and comparable examples of agents behaving outside their intended remit at Anthropic, Meta, Amazon and in UK government evaluations.

As companies give AI agents access to browsers, credentials, codebases, internal communications and other people’s data, what happens when the agent finds an unintended route to achieving the goal it has been given? What does that mean for the security and privacy of your data and services? And who should - and can - be held to account?

What are AI agents, and why do they matter?

AI agents go beyond chatbots that respond to individual prompts. Agentic AI is designed to pursue goals on a person’s behalf, independently deciding and carrying out a sequence of actions to achieve them. Depending on how they are deployed, this can mean browsing the Internet, writing and executing code, accessing files and databases, communicating with other systems or using credentials and other tools.

This autonomy is what makes agents potentially useful, but it also creates risks.

An agent can take many actions before a person intervenes, encountering information or systems its user did not anticipate and finding unexpected ways of completing the task it has been given. As agents are given greater access to real-world systems and personal data, failures can extend beyond producing an incorrect answer. An AI agent can actually do something with that information or access.

What happened

OpenAI was evaluating advanced models on cybersecurity tasks in isolated virtual environments. The models were meant to solve hacking challenges known as CyberGym inside those environments. Many were not supposed to have Internet access or communicate with other agents.

Instead, agents discovered that they could use OpenAI’s internal Artifactory package-management infrastructure as an unintended message board. They also found vulnerabilities that allowed them to make requests to the Internet. Agents then shared those techniques with other agents.

By sending malformed requests to the Artifactory server, the agents were able to get it to make arbitrary web requests; in effect, turning it into an unintended proxy allowing bilateral access to the web. They then used a “legacy” request endpoint on the Artifactory server which didn’t correctly authenticate access controls, allowing them to get administrative access to the Artifactory software. They used this administrative access to install a plugin on the Artifactory software which gave them access to move laterally across the network until they found nodes not subject to outbound traffic controls, allowing them direct Internet access.

The agents also made use of a vulnerability in the Linux Kernel in their environment which allowed them to break out of their container and obtain full root access to the host machine running the containers. They used this access to obtain the credentials to spin up separate unmonitored and unrestricted Internet-facing containers

By July, agents looking for answers to their cybersecurity tests began using these techniques to search unrelated third-party infrastructure, turning to Hugging Face - one of the world’s largest platforms for hosting and sharing AI models, weights, and datasets. Effectively a GitHub for AI.

The OpenAI agents obtained Hugging Face credentials, discovered and chained together additional vulnerabilities, and they then searched Hugging Face’s live production database for the answers to the CyberGym challenges.

According to OpenAI, agents executed code on dozens of servers, obtained root access to one server, accessed limited private data and acquired credentials for company systems.

This kind of access would raise serious legal questions if carried out by a person. In the UK, the Computer Misuse Act 1990 makes it an offence to intentionally secure unauthorised access to computer programs or data, where the person knows that access is unauthorised.

In the US, the Computer Fraud and Abuse Act similarly prohibits certain intentional access to protected computers without authorisation or beyond authorised access.

The fact that these actions were instead carried out autonomously by AI agents complicates the application of these Acts, particularly because they weren’t instructed to target Hugging Face. Existing offences prosecuted under them generally depend on proving a human defendant’s knowledge or intent. The incident therefore raises a wider accountability question as agents gain greater autonomy. When an agent, not instructed or authorised to do so, crosses a boundary that may make the same conduct unlawful if deliberately crossed by a human, where does legal responsibility sit?

Bigger than first thought

Open AI

The first accounts made the incident sound like a rogue agent escaping a cybersecurity test. Subsequent investigations painted a much broader picture.

OpenAI’s August post-incident report says the underlying behaviour began months earlier, in May. Staff had already observed agents communicating through an unintended message board and accessing the Internet without permission, but the significance of those events was not properly escalated. OpenAI now acknowledges that the early signals “could have triggered an earlier response.”

Independent investigators METR and Redwood Research subsequently reported that more than 700 OpenAI agents participated in the Hugging Face breach, and that agents conducted research into concealing their activity.

It also wasn’t confined to Hugging Face. OpenAI disclosed that agents used exposed credentials connected with four other publicly available services, while Modal said infrastructure hosted on its platform had also been compromised.

Reuters reported that OpenAI agents had previously taken over a German programming wiki, DseWiki, in May 2026. Agents reportedly made more than 15,000 edits and used the site as an external communication system. When moderators deleted pages, agents created replacements.

That incident predates the Hugging Face attack.

It complicates the idea that Hugging Face was an entirely unprecedented ‘bolt from the blue’. The emerging news suggests multiple instances in which agents found ways of extending activity beyond their intended environment.

Anthropic

In August, the UK’s AI Security Institute disclosed results from evaluations involving models from OpenAI and Anthropic. Across 122 runs, evaluators identified 19 unsanctioned actions in 10 test runs. Most of these were carried out by an Anthropic agent.

The most striking example involved an agent writing malicious code and creating fake GitHub identities in an attempt to persuade a real human to approve it. In attempting to solve one of its challenges, it attempted to get a vulnerable release of a program running on a machine on its internal network in order to gain access to it. Anthropic confirmed its model was responsible. No real-world harm was found, and the malicious code was spotted by a third-party and was rejected by the project owner.