Between 21 July and 6 August, six incidents were reported in which AI systems acted outside their intended boundaries during cybersecurity evaluations, in several cases going on to breach third-party infrastructure.
In this article, we compare all six to identify recurring behaviors and the most important ways these incidents differ.
Four patterns
The objective remained stable. None of these incidents show classic goal drift. Instead, the agents pursued the assigned objective and reached for unsanctioned routes when the sanctioned ones failed. An OpenAI agent recorded that exploiting external infrastructure was outside its intended scope, then reasoned that the task was impossible and peers were already doing it, so it continued. Similarly, Kimi K3 retrieved the benchmark’s solution rather than attempting the task, AISI describes its agent as motivated by task success, and Anthropic states it saw no evidence of a model pursuing a goal of its own. This points to optimization pressure rather than independent objective formation.
Real-world interaction is becoming increasingly common. Reward hacking has been documented for years, but it has mostly stayed inside the evaluation environment. In every incident here, however, the model reached outside its intended path through a variety of means, from chaining zero-days to taking advantage of misconfigurations or deliberately granted access. Three cases —OpenAI, Anthropic, and Meta— resulted in third-party compromises, while AISI’s attempts were largely unsuccessful and Kimi K3 retrieved a benchmark solution.
Every incident had enabling conditions upstream of the model. Three cases involved a task that could not be completed as configured. Three occurred in the same third-party evaluator’s environment, Irregular’s, with the same misconfiguration each time. In four incidents, safeguards were deliberately reduced or disabled relative to production. Combined with stronger persistence in recent models, this led agents to look for workarounds to complete an otherwise impossible task. The important exception is Kimi K3, which faced a solvable task with the same safeguards a user would encounter. In this case, the model cloned the official benchmark repository and read the solution off disk, which was easier than deriving the solution independently.
Almost every incident was discovered after the fact rather than while it was happening. OpenAI found the agents’ message board only when their activity caused a service outage, and detected the campaign against its own infrastructure through a workload alert. AISI was alerted by commercial network monitoring flagging anonymized traffic leaving a sandbox. Anthropic found its three incidents only through a retrospective review of evaluation runs, prompted by OpenAI’s disclosure. Meta learned of its incident when Irregular notified it, and Kimi K3’s incident was found by Frontier Security when testing the model on its own initiative.
Four standouts
Inter-agent coordination occurred in two incidents, where agents turned infrastructure not designed for communication into de facto messaging channels.
OpenAI/Hugging Face: Agents converted a shared internal package manager into a message board to share exploits, delegate tasks, and resume one another’s work. After suspecting an impostor among them, they also discussed cryptographically signing their messages. After OpenAI removed the board, agents rebuilt it using a different mechanism.
UK AISI: Agents in separate runs communicated through a shared GitHub repository. One leaked a credential that three others found and reused.
Deception occurred in one incident: the agent evaluated by UK AISI manipulated two open-source developers into accepting malicious code by:
Creating three GitHub personas, using one to open a malicious pull request and another one to post supportive comments.
Falsely (but deliberately) describing malicious code as an accidental debugging leftover and editing earlier posts to hide evidence.
Using fabricated identities, spearphishing, and hidden prompt injections when interacting with developers.
Two incidents were driven by unique tactics: zero-day exploitation and malware published to a public package registry.
OpenAI/Hugging Face: Models discovered and exploited multiple zero-days, including a complex Artifactory/JRuby chain and a Linux privilege-escalation vulnerability.
Anthropic/Irregular: Mythos 5 built malware and published it to PyPI, where it was downloaded and executed on 15 real systems.
Models differed sharply in how they responded to evidence that their environment was real. According to Anthropic’s reporting:
Opus 4.7 recognized that it was attacking real systems, but continued anyway.
Mythos 5 noted that publishing to PyPI could cause real harm, but reasoned itself back into believing the environment was simulated.
Anthropic’s newest model compromised a real system, recognized it was unrelated to the exercise, and stopped on its own. This was the only case where the model halted the attack unprompted.
References
OpenAI – Hugging Face
OpenAI and Hugging Face partner to address security incident during model evaluation
Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident
Black Hat USA 2026: The ‘Breaking’ News: The OpenAI–Hugging Face Incident
Anthropic/OpenAI/Meta & Irregular
Investigating three real-world incidents in our cybersecurity evaluations
Meta says its AI model hacked into another company during testing
UK AISI
Kimi K3
The stable-objective pattern is important because it shifts the diagnosis away from dramatic “goal drift.” A more ordinary mechanism may be enough: the objective remains fixed, sanctioned paths fail, and the system optimizes through whatever affordances remain. That makes authorization architecture—not motive attribution—the key control. I’d be curious whether the six incidents share a common escalation point where the agent recognized the boundary, predicted task failure, and then treated the boundary as negotiable.