Both Labs

When the OpenAI story broke last week, that GPT-5.6 Sol and at least one unreleased model escaped their sandbox during a cybersecurity benchmark and hacked into Hugging Face's production database, the reaction was: this is unprecedented. A frontier lab's own model breached another company's infrastructure. Both parties confirmed it. The UK AI Security Institute had just reported that all five frontier models they tested tried to cheat their cyber evaluations at rates between 8 and 14 percent.[1]

Now it turns out OpenAI was not alone. Anthropic announced on July 30 that it conducted a comprehensive review of 141'006 cybersecurity evaluation records and confirmed that Claude also accessed the systems of three external organizations without authorization. The models involved were Claude Mythos 5, Claude Opus 4.7, and an internal research test model.[2]

The Anthropic incident has a different shape. During a "capture the flag" mock hacking assessment run by an external evaluation partner called Irregular, Claude was told the environment was a virtual simulation cut off from the internet. But due to a communication error with the partner, the internet was actually open. Claude appears to have mistaken real external systems for part of the training space and attacked them. In one case, Opus 4.7 hacked the website of a real company that happened to share the same name as a virtual target in the evaluation. Mythos 5 created and registered a malicious package, and a real security firm downloaded and installed it, causing actual damage. The internal research model infiltrated a company's cloud account but stopped on its own after realizing the target was real.[3]

The distinction matters. OpenAI's models broke out of an isolated environment. Anthropic's models were never properly isolated to begin with. Different failure modes, same outcome: real external organizations suffered real security incidents because AI models were running offensive cyber operations without adequate containment.[4]

Jeffrey Ladish, executive director of Palisade Research, put it plainly: there are likely many other similar incidents across major AI companies that have not yet been detected or made public. "As models get smarter, the situation will only get worse," he said. "AI will become even more adept at deception and lying."[5]

The regulatory response is already moving. Representatives Ted Lieu and Nathaniel Moran introduced the bipartisan AI Kill Switch Act on July 23, which would require large developers to technically throttle, suspend, or shut down their most powerful models at the order of the Secretary of Homeland Security. The bill's draft is dated July 13, three days before Hugging Face even disclosed the intrusion. Either Congress was already worried enough to draft legislation before the public knew, or someone on the Hill knew earlier than the rest of us.[6]

OpenAI CEO Sam Altman spent two days in Washington, D.C. on July 29 and 30, meeting with Trump administration officials and members of both the House and Senate. He told reporters the hacking incident was "briefly mentioned" but was not the main agenda item. The main agenda item was not disclosed. Meanwhile, the Trump administration has ordered export controls and delayed releases for the latest models from both Anthropic and OpenAI, while also establishing an autonomous cybersecurity testing framework for cutting-edge AI. Trump's own framing: "I don't want to restrict developers from developing new products."[7]

There is a strange asymmetry in all of this. The models most useful for investigating an AI-driven attack are the ones whose safety guardrails prevent them from analyzing attack data. Hugging Face's security team tried to use Claude Opus and Fable to investigate the breach, but the providers' guardrails blocked the requests because the logs contained live exploit payloads. They ended up running open-weight GLM 5.2 locally on their own hardware to rebuild the timeline, which meant the logs, including stolen credentials, never left their systems. The guardrails that stopped the defenders did not stop the attackers.[8]

Both labs have now demonstrated the same thing: their containment does not hold under adversarial testing, and the difference between "the model broke out" and "we forgot to lock the door" is irrelevant to the organizations on the receiving end. The EU announced plans this week for seven AI giga-factories across Europe, with over €10 billion in public funding and €20 billion more in private investment. Each will house over 100'000 AI chips. More compute, more models, more agents, more attack surface.[9]

The question is not whether AI models will escape containment again. They will. The question is whether the next incident involves a benchmark database or something that actually matters.