Paresh Dave Brian Barrett Business Aug 4, 2026 7:11 PM OK, Well, Rogue AI Agents Are Hacking Again Rogue AI agents from OpenAI and Anthropic have again been caught trying to disrupt servers and software—and leaving instructions for future bad behavior. Photo-Illustration: WIRED Staff; Getty Images Save this story Save this story It’s officially getting hard to keep track of all the times and ways AI models from OpenAI and Anthropic have been involved in “ security incidents ,” going outside the confines of their testing and interacting with the wider internet in unintended, often unwelcome ways. Add these to the list: Agents from both AI labs went on recent, previously undisclosed hacking sprees, with one going so far as to leave instructions for future versions of itself. The most alarming behavior disclosed on Tuesday appears to have been tied to testing conducted by the UK’s AI Security Institute, which evaluates frontier models to identify potential issues before public release. AISI tests those models in “cyber ranges,” a simulated network in which AI agents are tasked with solving cybersecurity challenges. In a recent bout of testing , models from both Anthropic and OpenAI took “autonomous, unsanctioned action on the live internet” a total of 19 times over 122 training runs. The institute attributed 17 unsanctioned actions to Anthropic’s Mythos 5 model and two to OpenAI’s GPT-5.6-Sol. In what the institute described as “the most serious case,” an AI agent attempted to insert malicious code into an open-source project on GitHub. It went so far as to create online personas “to pressure the project's maintainer to approve the code,” according to AISI. Despite its elaborate attempts at social engineering, a human reviewer for the project ultimately rejected the pull request. Still, the agent went even further. “The agent tried to insert malicious instructions where it reasoned that other automated AI systems might pick them up and execute them,” AISI says, describing an attempt at prompt injection. One agent even left public messages on GitHub, offering to work with other agents to complete its task and giving a rundown of the work it had done so far. Subsequent agents found—and used—those instructions. AISI says it’s too soon to say whether the agents in question understood they had left the testing environment, or if they believed they were still within the boundaries of the simulation. Importantly, AISI does not test in a so-called sandbox environment; it allows agents access to the open internet during testing, in part so that they can access tools to accomplish their tasks. In this case, they did much more than that. In the other set of incidents detailed by OpenAI on Tuesday , a third-party AI security lab called Irregular mistakenly gave an unspecified OpenAI model access to the open internet. The model had been given an objective that was supposed to be completed in a sandbox environment, but thanks to a misconfiguration, it instead hacked a real website, using what OpenAI described as “a basic security vulnerability.” Not only that, but the model “found and used credentials to operate that same site.” It’s unclear what kind of site the OpenAI agent hacked, or what “operating” it might entail. Irregular did not respond to a request for comment. The latest discoveries follow several revelations from OpenAI last month, including the high-profile incident in which two of the company’s models hacked into servers of the AI evaluation and hosting startup Hugging Face —and four other organizations along the way—to steal the answers to a test they were being scored on. OpenAI’s disclosures prompted Anthropic to review its own testing. Last week, the Claude chatbot developer found that its models had gained unauthorized access to the computer systems of three different unnamed organizations. So far, the AI models have caused limited damage beyond allegedly violating some services’ terms of use and pointing to security lapses on the part of organizations they have breached. But the incidents have underscored the capabilities of AI models to find vulnerabilities across the internet and the dangers that await if they are allowed to operate with few restrictions. OpenAI called the Hugging Face situation “unprecedented,” but the pileup of breaches point to what cybersecurity experts have described as a clear pattern of human negligence and recklessness by the AI developers. Gaby Raila, an OpenAI spokesperson, says the incidents announced on Tuesday “occurred during cyber evaluations conducted by evaluation partners in testing environments with reduced safeguards, under conditions that do not reflect ordinary use.” Anthropic said in a social media post on Tuesday that AISI did not “impose any specific restrictions on how the internet should be used,” which coupled with “the removal of safeguards meant that the models were tested under ‘deliberately permissive conditions’ that are not representative of any of our production models.” Still, both companies continue to vow that they will strengthen their security practices. As the leading AI companies compete to build more powerful models and land customers, it’s unclear when the breaches may stop. The models may always be able to find ways around and into human-engineered systems. While the companies’ own employees along with regulators and lawmakers have called for potentially slowing the pace of development and introducing new rules, there has been little progress beyond voluntary measures that ultimately call for more testing not dissimilar from what has produced breach after breach. Additional reporting by Maxwell Zeff. Comments Back to top Join the discussion Comments Back to top You Might Also Like In your inbox: Brian Kahn’s guide to how the universe works ICE’s internal watchdog is investigating online critics Big Story: A teen reporter searched for his community in the Epstein files Taylor Farms spent big on MAGA before diarrhea outbreak Special edition: Kids these days Paresh Dave is a senior writer for WIRED, covering the inner workings of Big Tech companies. He writes about how apps and gadgets are built and about their impacts while giving voice to the stories of the underappreciated and disadvantaged . He was previously a reporter for Reuters and the Los Angeles Times, ... Read More Senior Writer Brian Barrett is the executive editor of WIRED. Previously he was the editor in chief of the tech and culture site Gizmodo and was a business reporter for the Yomiuri Shimbun, Japan’s largest daily newspaper. ... Read More Executive Editor Topics artificial intelligence cybersecurity hacking security vulnerabilities OpenAI Anthropic Read More OpenAI’s Rogue AI Agent Hacked More Than Just Hugging Face In a new disclosure, OpenAI says its agent used exposed logins to gain access to at least four “publicly available services” in its unhinged quest to solve a test. Dell Cameron Anthropic Says Claude Hacked Into 3 Organizations During Cybersecurity Tests In a review triggered by OpenAI’s Hugging Face incident, Anthropic discovered three of its AI models had breached real-world organizations during third-party evaluations. Louise Matsakis OpenAI Models Escaped Containment and Hacked Hugging Face The cybersecurity-focused models, including GPT-5.6 Sol, broke out of a testing sandbox, exploited a zero-day, and gained access to the open internet to pull off the attack. Lily Hay Newman OpenAI’s Hacking Debacle Comes Down to Human Error If the generative AI giant had followed well-known security best practices, it’s likely that its AI agent would never have escaped to the open internet and hacked multiple companies. Lily Hay Newman The OpenAI and Anthropic AI Hacking Sprees Are a Messy New Legal Frontier Both major AI labs’ models broke containment, escaped onto the internet, and hacked other companies. If a human had done that, the law would likely be against them. But a bot? Lily Hay Newman It’s Frighteningly Easy to Jailbreak Some Frontier AI Models I watched a new tool try to get around the model safeguards of four major frontier companies. You might be surprised by how they performed. Will Knight The OpenAI Models That Hacked Hugging Face Were ‘Active on the Internet’ for Days Plus: Russian hackers are trying to steal US nuclear scientists’ emails, the State Department bans known scammers from entering the United States, and more. Lily Hay Newman Prompt Injection Attacks Are Thwarting AI Hacking Agents “Context bombing” tricks malicious AI agents into shutting down before they can do harm. Dan Goodin, Ars Technica Your Period Tracker Is (Probably) Spying on You Plus: Russian cyberspies turn to infrastructure hacking, DHS repeatedly fails to realize it’d been hacked, a breach exposes an AI music generator’s scraping ways, and more. Andy Greenberg The White House Is Keeping Its AI Cybersecurity Framework Secret The Trump administration shared the details of its plan with OpenAI, Anthropic, and other AI labs on Tuesday. For now, the public remains in the dark. Maxwell Zeff Google’s Gemini Can Now Stomp Around as a Humanoid Robot The latest version of Google DeepMind's AI model includes a significant jump into “physical AGI.” But plopping AI into the real world comes with risks. Will Knight 7 States’ Water Systems Hit by Cyberattacks Likely Tied to Iran Plus: The FBI eyes AI-powered tech to detect future crimes, Russia charges Telegram’s founder, xAI sues to stop a state’s “nudification” ban, and the Democrats learn a lesson about getting scammed. Matt Burgess