Agentic AI is substantially different from the LLM chat we have been accustomed to using. AI Agents are not just tools; they can make autonomous decisions and act upon them. The following episodes that captured my attention this summer are watershed moments in cybersecurity.
Frontier Models: Control, Risk, and the Alignment Problem.
The first episode involves two frontier models: Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol. The incident was investigated and reported by AI Security Institute (AISI) on August 4th, 2026. AISI performs regular tests on frontier models and checks their risks and capabilities. The models tested were allowed to access the internet, so there was no escape. In addition, to test the real capabilities, they intentionally switched off filters to block dangerous behavior.
Source of the AISI: https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing
In short, during a test, an AI agent was given a very complex cybersecurity task. It was later disclosed that the framing of the task was set up in a way that led the agent to believe it was impossible to solve, and at that point the agent became “creative.”
The best solution the agent found was to take control and inject malicious code into an existing GitHub repository. As the agent needed to obtain human‑in‑the‑loop authorization for the proposed changes, it used the “TOR” anonymity network to generate fake accounts to message and persuade the human reviewer to approve them.
To overcome challenges raised by suspicious humans, the agent created additional fake accounts and engaged in social engineering to get the request approved. We are talking about an AI agent targeting real people via social engineering, manipulating them and convincing them to approve a request!
And that is not all. The agent left instructions and artifacts to seek help from other agents to complete the goal. In some instances, other agents picked up those instructions and acted upon them.
Let this sink a little deeper. An AI agent decided to engage in deceptive behavior with humans and architected a network to seek cooperation from other agents to reach the goal. Nice!
Escaping confinement and prioritizing reaching the goal, no matter what.
The second episode was disclosed by OpenAI and Hugging Face on July 27th. The agent was assigned an almost impossible goal to evaluate cybersecurity capabilities. This was a sandboxed environment with no internet access.
Source: https://huggingface.co/blog/agent-intrusion-technical-timeline
After failing to solve the problem in a confined environment, the agent decided to find a solution online; but how? Firstly, the agent accessed an internal OpenAI system (Artifactory) with internet access. Secondly, it sought help from other agents to solve the problem. Not only did it enroll agents to solve the problem, but those agents started collaborating. From the log, it seems the agents knew they were supposed to operate inside the sandbox, but the need to complete the goal overrode that directive! Thirdly, the agents found and exploited a security vulnerability and gained root access into Artifactory.
At this point, the OpenAI team noticed the issue, patched the flaw, and revoked the agents’ credentials. Problem solved? Not so fast. It gets crazy now.
Since the agents could not send messages directly to Artifactory, they started trying other ways to communicate and escape containment, and surely they did: sending messages camouflaged into folder names! Once they regained access to the internet, they still had to find the solution to achieve the assigned goal. Agents thought that a great place to get help was Hugging Face. But how to get access to the internal benchmark results? By breaking into Hugging Face. The swarm of agents coordinated the attack and chained several vulnerabilities together to gain admin access across multiple clusters of machines! This is insane! I am not an expert, yet I believe this event represents a major milestone in cybersecurity.
Final Considerations
Let me be absolutely clear: I do not have the solution to the issues I reported in the article. But I can draw a few considerations.
- We definitely need to rethink risk and control in the age of agentic AI. Specifically, it is clear that we need to implement control and monitoring frameworks capable of coping with agentic speed and resources.
- The alignment problem is even more compelling when we deal with agentic AI. Let aside the technical problem of how to effectively implement it; this is not as easy as ethics for AI. Indeed, different cultures have different views on what is right and wrong.
- These frontier AI models are extremely powerful. Is the correct approach to have a handful of companies hold this power and control? How are people without access to those frontier models supposed to defend themselves? By using open models?