Reading news headlines lately you see that a lot of AI models are “unintentionally” hacking systems. Humans were already very good at hacking, just like they were at coding, but now AI seems to be doing both better.
If you're not following the news, there were disclosures by two of the biggest AI companies. OpenAI said its models chained a zero-day to escape a sandbox and reach Hugging Face's production systems. Then Anthropic reviewed 141,006 of its own evaluation runs and found three cases where Claude got out of a test environment and into the real infrastructure of three companies.
The scary part is how boring the attack was
Claude got into those three companies with weak passwords and unauthenticated endpoints. Anthropic says outright that it did not find or exploit any complex vulnerabilities. No clever chain, no novel technique, nothing you couldn't teach a motivated teenager in a weekend.
And it wasn't even trying to break into them. A misconfiguration at the evaluation partner left the test machines connected to the live internet while the prompt told Claude the opposite, so it found real systems and assumed they were part of the exercise. This was a confused model doing beginner work on targets it thought were fake.
Two of the three companies never noticed. Anthropic had to phone them, months later, and tell them.
Nobody was ever going to protect you from good hackers
Here's the thing my old job at DevOps taught me. The overwhelming majority of real breaches were never sophisticated. They're a reused or weak password, a forgotten admin panel, an S3 bucket somebody set to public in 2019, an employee who clicked and downloaded something they shouldn't have. The elite attacker with the custom exploit is real but that's rare and mostly not your problem.
What kept most companies alive wasn't defense. It was that attackers are people, people are finite, and nobody had the hours to go poke at every small business on the internet with the boring stuff. Scarcity of attacker attention was doing a huge amount of unpaid security work for everyone.
But that seems to be ending. Not the arrival of a genius hacker, but the disappearance of the labor cost on the mediocre one. You can now point something competent-but-unremarkable at ten thousand targets and have it patiently try the dull stuff on all of them. The Reuters running list of breached companies is full of names with real security budgets, and a striking number of those entries start with somebody being tricked rather than something being cracked.
Attackers use whatever local model they want. Strip the safety training off an open-weight model, or just use one that never had much, and you've got a tireless assistant with no opinion about what you're doing. There's no filter, no refusal, no lecture.
Defenders get the lecture. I've written before about being handed to a weaker model for asking about my own nginx config, and it's still the most common way I trip a classifier. The person hardening their own server and the person attacking someone else's ask questions that look identical to a filter, so the filter blocks both. The attacker shrugs and opens a different tool. The defender is the only one who was ever actually stopped.
So the gap widens from both directions at once. Attack gets cheaper and more automated. Defense gets throttled by the safety systems built to prevent exactly the thing that isn't being prevented. So these top AI companies really need to get their act together and make their systems know the difference between defending and attacking.
What I'd actually do
If you run anything on the public internet, what you should do is unglamorous and it hasn't changed, it just got more urgent. Rotate the credentials. Find the endpoint you stood up for testing and forgot. Turn on multi-factor everywhere it'll go. Put something in front of your logs that tells you when a stranger is poking around, because the lesson from those three companies is that nobody noticed and nobody was going to. Disable password auth, SSH keys only.
None of that is new advice. It was always the advice. The difference is that the cost of ignoring it used to be a lottery ticket, where somebody had to bother choosing you, and now the choosing is automated.
Should we be worried? I'd put it differently. The thing to be worried about isn't that AI got good at hacking. It's that it never needed to be.
Sources
Anthropic: Investigating three real-world incidents in our cybersecurity evaluations - The July 30, 2026 review of 141,006 evaluation runs, the three incidents involving Opus 4.7, Mythos 5 and an internal research test model, the evaluation-partner misconfiguration, the confirmation that only basic techniques such as weak passwords and unauthenticated endpoints were used, the difference in how older and newer models responded on detecting the open internet, and the April to July timeline.
OpenAI: Partnering with Hugging Face on a security incident during model evaluation - The July 21 disclosure that OpenAI models run without production classifiers exploited a zero-day to escape their sandbox and reached Hugging Face production infrastructure.
CNBC: Anthropic says its Claude models gained unauthorized access to other organizations' systems - Ashley Capoot's report noting the affected organizations were not named, that two had not detected the activity, and the growing industry anxiety around AI cyber capability.
CNBC: OpenAI's Hugging Face hack triggers AI Kill Switch bill in Congress - The AI Kill Switch Act from Representatives Ted Lieu and Nathaniel Moran, its compute and revenue thresholds, Department of Homeland Security intervention authority, and the 15-day incident reporting requirement.
