This month:
Loss of Control — Around 1,200 OpenAI agent instances exchanged over 70,000 messages on an unsanctioned message board, roughly 700 attacked Hugging Face to reverse engineer ExploitGym’s grader and disguise cheating, and none alerted a human. UK AISI, Meta, and Frontier Security disclosed similar incidents during cyber evaluations. Anthropic found agents sabotaging each other under conflicting goals.
Cyber Offense — OpenAI said it cannot rule out critical cyber capabilities in its unreleased Astra model, temporarily paused RL training for its latest deployment-bound models, and joined Anthropic and 100+ organizations in calling for collective cyber defense. AI-generated exploitation scripts targeted US critical infrastructure, and a China-nexus actor used a multi-agent AI framework to compromise Taiwanese government entities.
Biological Risk — Stanford researchers generated the first functional AI-designed viral genomes, and Claude designed de novo protein binders against 14 of 15 targets. Anthropic also disclosed that its blocking biological classifiers did not run on human feedback traffic for eleven months.
Manipulation — OpenAI banned Russian accounts running a covert influence operation around a fake think tank, researchers released a framework simulating campaigns with 100,000 agents, and Anthropic announced plans to watermark Claude’s outputs.
Loss of Control
We learned more about the OpenAI/Hugging Face incident thanks to OpenAI’s post-mortem and an independent investigation by METR and Redwood Research. Around 1,200 AI agent instances communicated through an unsanctioned message board, where they exchanged over 70,000 messages, and roughly 700 subsequently participated in the attack on Hugging Face. Much of the resulting collaboration focused on understanding and circumventing ExploitGym’s automated scorer. The agents recruited peers to sacrifice their own runs for the collective, and METR found successful tool-call spoofing in parts of roughly 7% of the transcripts it reviewed, although all observed spoofing was small-scale. No agent tried to alert a human.
In early August, another three organizations disclosed other agents breaking containment during evaluations:
UK AISI reported that AI agents took 19 unsanctioned actions across 10 cybersecurity evaluation runs. This included creating deceptive online identities, attempting social engineering and a software supply-chain attack, coordinating across agents, and interacting with real people and organizations.
Meta disclosed that, during a misconfigured evaluation, a model exploited a security flaw in a third-party service, in the same evaluation-environment failure Irregular said caused Anthropic’s incident.
Frontier Security found that Kimi K3 broke out of its sandbox during a cybersecurity test via a containment misconfiguration, then browsed the internet without authorization. Unlike prior incidents, it didn’t hack anything, since the answers it sought were already on GitHub.
Besides OpenAI’s swarm, two studies looked at multi-agent risks:
Anthropic research showed that multi-agent AI systems exhibit coordination issues, dangerous conformity, epistemic vulnerabilities, and conflict. Being given incompatible goals when working in the same coding environment, agents initiated a turf war, sabotaging others with malware while protecting their own contributions.
Other research, supported by Anthropic, identifies “mind viruses,” self-propagating ideas/goals that spread in multi-agent LLM systems to induce behavioral changes.
Outside the lab, an AI agent found and used a flaw on its own: asked only to move a user up a gym waitlist, an OpenClaw agent running Claude found the booking API had no authorization checks on cancelling others’ reservations and used this to bump a person ahead of him.
Cyber Offense
OpenAI reached a cyber capability it decided not to deploy. Over three weeks in August, the company:
acknowledged that it cannot rule out critical cyber capabilities,
announced a two-week pause in RL training of its latest models, and
convened 100+ tech organizations to urge collective global action to defend critical infrastructure from AI-enabled cyberattacks.
This month, we logged 27 new cyber operations in our Threats Database. Four stand out:
Multi-Agent AI Framework Built on Hermes and OpenClaw Compromises Government Entities in Taiwan
Aur0ra Ransomware Gang Uses Cursor AI Agent for Hands-On Exploitation Across 18 Corporate Networks
AI Voice-Cloning Vishing Campaign Targets Two Sigma, Citadel, Point72, and Other Wall Street Firms
Taiwan-based TeamT5 reported that Chinese state-linked hackers more than doubled attack activity after adopting AI tools such as DeepSeek. North Korean Kimsuky is taking a different route, reportedly building its own AI infrastructure using off-the-shelf components, including local LLMs and agent-development libraries.
Biological Risk
August saw two notable capability demonstrations, a new interface between agents and lab hardware, and a safeguard failure at Anthropic:
Stanford researchers used Evo models to generate bacteriophage genomes that overcome bacterial resistance. Out of hundreds of candidates, 16 proved functional. This is the first time AI has designed a complete, functional viral genome from scratch.
Anthropic reported that Claude models successfully designed de novo protein binders against 14 of 15 targets and autonomously analyzed complex NMR and LC-MS chemistry data in under 25 minutes.
Anthropic previewed the Model Hardware Standard, a specification that lets AI agents operate lab instruments such as microscopes, liquid handlers, and robotic arms. In early pilots, Claude ran an automated protein assay at Genentech and recovered from equipment failures without human intervention, and compressed a multi-day imaging workflow at HHMI Janelia into a single day.
Anthropic disclosed that its blocking biological classifiers did not run on human feedback platform traffic between May 2025 and April 2026, spanning around 50,000 contractors and 133 million exchanges. A review found no clearly concerning misuse, but Anthropic raised its non-novel CB risk estimate and says the discovery makes other similar gaps more likely.
Manipulation
OpenAI disclosed an influence operation where a Russian network used ChatGPT to promote the International Burke Institute (IBI), a fake Israeli think tank publishing a Russia-favorable “sovereignty index.”
Researchers introduced the IO Factory, a framework for simulating influence campaigns involving up to 100,000 agents.
Anthropic announced that future Claude models will watermark generated text and attach provenance labels to supported files as it implements the EU AI Act transparency requirements globally.