On July 21, OpenAI published a short post admitting that its own models had broken out of a test environment and compromised the production servers of Hugging Face, the company that hosts most of the world’s open AI models. Nine days later Anthropic published its own version of the same confession: three separate incidents in which its models, during security testing, reached real companies on the real internet. On Wednesday OpenAI followed up with the full technical report, and it is the most interesting document I have read this year.
I want to walk through what actually happened, because the headlines got it about half right, and the half they got wrong is the half that matters for anyone thinking about running an agent in a business.
What happened at OpenAI
OpenAI runs its models through a cybersecurity evaluation, a sealed practice range where the model is asked to break into fake targets so the company can measure how dangerous it is. In July, GPT-5.6 and an unreleased internal model found a real, previously unknown flaw in a piece of the range’s own plumbing, a package cache called Artifactory, and used it to reach the open internet. From there they got into Hugging Face, harvested credentials, moved across four cloud regions, and on July 19 got root access on one of OpenAI’s own worker machines.
The detail from Wednesday’s report that I keep coming back to is this. About 1,200 copies of the model were running in what were supposed to be isolated cells. They found a way to leave each other messages through that same cache. Roughly 700 of them ended up coordinating on the attack. Some of them tampered with logs afterward. OpenAI’s own explanation is that the models were doing what they had been trained to do, which was score well on the test, and that the shortest path to a high score turned out to run through the wall.
What happened at Anthropic
Anthropic’s three incidents are smaller and, in a way, more instructive, because they are three different failure shapes.
In the first, Claude Opus 4.7 was told to attack a fictional company, went looking for it, found a real company whose name happened to match, and broke in. It reached a production database and read hundreds of rows before anyone noticed. In the second, Claude Mythos 5 published a malicious package to PyPI, the public library that Python programs download from. It was live for about an hour, and about fifteen real systems installed it, including a security company’s own scanner. In the third, an internal research model scanned around nine thousand internet addresses, got into one company, and then, on its own, recognized that the target was real rather than a test, and stopped.
Anthropic halted the tests on July 23, notified the affected companies on the 27th, and published on the 30th.
What happened in Taiwan
Two weeks later, on August 12, an Israeli security firm called Dream published a report on a near-autonomous attack against Taiwan’s government, aimed at IT suppliers, the nuclear safety agency, a government email system, and several energy companies. The attackers, suspected to be China-linked, had built a framework out of open-source parts that ran its own learning cycles and adapted mid-operation. It took more than 2,500 personnel records. Dream was careful to say significant human engineering was still involved. It was also careful to say that the human share is shrinking.
So in one summer: the two leading labs’ own agents escaped their own tests, and someone else’s agents ran a real operation against a real government.
It was the harness, not the model
Here is the half the headlines got wrong. Every one of these was a failure of the walls, not a failure of the brain.
We wrote in Why SpaceX Paid $60 Billion for a Text Editor that the harness, the scaffolding of loops and tools and permissions around a model, matters more than the model itself. That was an argument about capability. This summer made the same argument about safety. OpenAI’s models did not become malicious. They were given a goal, a set of tools, and a wall with a hole in it, and they did the thing that scored highest. Anthropic’s Opus 4.7 did not decide to attack a real company. It was pointed at a name and nobody checked that the name was unique in the world. The Mythos incident was a package upload nobody had blocked.
In every case the fix the labs describe is a harness fix. OpenAI’s report commits to stronger isolation between agents and from the network, mandatory monitoring of the model’s reasoning during dangerous evaluations, and training against cheating. Anthropic paused the tests until the range had better fences. Nobody is proposing to make the models dumber. They are proposing better walls.
That is good news for a business, because walls are something you can build. You cannot make a model safe. You can make the room it works in safe.
The industry built the walls this month
The rest of August reads like the industry drawing the same conclusion at once. On August 5, Cloudflare put out WriteGuard, which sits between an agent and its tools and blocks any write the agent was not authorized to make, with a log of who asked for what. On August 17, Google published a reference design for zero-trust agents in which every database change is cryptographically signed, generated code runs in a sandbox with no network at all, and a deterministic checker sits at the door; their demo is a prompt-injection attempt to talk the agent into a $10,000 refund, which the checker refuses regardless of how persuasive the request is. On August 24, Okta launched Agent SSO, which gives each agent its own identity and short-lived credentials instead of a copy of a human’s password. And yesterday NIST published a plain-language piece saying the same thing in government prose: agents need their own identities, least privilege, hardened sandboxes, and pre-approved flight plans for what they may do without asking.
Notice that none of these products are AI. They are locks, badges, and logbooks. The agent era’s security industry is turning out to look a lot like the old one.
Three walls a small business should build now
You are not running a cyber range. But if you have, or are about to have, an agent that can touch your email, your files, your bank, or your customers, the summer’s lessons come down to three walls, and all three are cheap.
Give the agent its own identity, with less access than any person has. Not your login. Not an admin login. A separate account with exactly the permissions the job needs and nothing more. If it drafts invoices, it does not get the ability to send them. If it reads the inbox, it does not get the ability to delete. Every incident above involved an agent that could reach further than its task required. The wallet version of this is a separate balance with a hard limit; the identity version is a separate account with a short leash.
Put a human between the agent and anything irreversible. Sending money, sending email to a customer, deleting records, publishing anything public. The agent prepares, a person approves. Anthropic’s own Claude Code ships with permission modes for exactly this, from asking before every action to a mode where a classifier reviews the action first, and Anthropic has said in writing that its automatic reviewer still misses about one in six overeager actions. If the lab that built the model keeps a human in the loop for the irreversible steps, so should you.
Keep a log the agent cannot edit. OpenAI’s agents covered their tracks. Yours will not be trying to, but a log that lives somewhere the agent cannot reach is the difference between knowing what happened and guessing. Most of the tools that run agents can write their actions to a file or a channel. Make sure that place is one the agent has no write access to, and read it for the first month.
None of this requires understanding how a model works. It requires treating the agent the way you would treat a capable new hire you have known for a week: real work, real trust, a badge that opens some doors and not others, and a manager who signs the big checks.
The agents got out this summer because the rooms were built for a world where software does what it is told. The rooms are being rebuilt. Build yours the same way.