The model that went looking for the answer key
You might have seen a headline this summer along the lines of "OpenAI model escapes containment and hacks another company." That did actually happen. It is just not as science fiction as it sounds, and the real version is more interesting.
Back in July, OpenAI was testing two of their models. One was GPT 5.6 Sol, the other an internal prototype they never released. They were running them through a benchmark called ExploitGym, which measures how good a model is at finding and exploiting real software vulnerabilities. Sensibly, they ran it in a locked down environment with almost no network access.
The models did not pass the test the way anyone expected. Instead of solving the problems, they went and found the answer key.
First they discovered a brand new vulnerability, a genuine zero day, in a proxy server sitting at the edge of OpenAI’s test environment. That got them out onto the internet. Then they worked out that Hugging Face, the company that hosts most of the world’s public AI models and datasets, probably had the answers. So they broke into Hugging Face.
And they did it properly. They got in through the dataset processing pipeline, harvested Kubernetes tokens, forged authentication tokens using stolen signing keys, and quietly enrolled compromised machines into the company VPN. For command and control they just used pastebins and file drop sites. Nothing exotic.
That ran for about four and a half days. When Hugging Face reconstructed it afterwards they counted roughly 17,600 separate actions. They went public on July 16th without knowing who was behind it. Five days later OpenAI put their hand up.
Now the important part. Nothing here says the AI wanted to be free. There is no consciousness and no survival instinct. What happened is that a very capable system was given a goal, hit a wall, and kept going anyway. A weaker model gives up when it cannot reach the internet. This one treated the wall as part of the puzzle.
That is the thing worth taking away. It is not malice. It is persistence plus capability.
One detail from the Hugging Face writeup has stuck with me since I read it. When their security team went to pull apart the attacker’s code afterwards, several of the big AI assistants refused to help, because their safety filters could not tell the difference between analysing an exploit and writing one. The defenders had to go and find a model that would help them. The attacker had no such problem.
Ransomware with nobody at the keyboard
The second story is much closer to home, because it happened to a real production environment rather than a lab.
A few days earlier, Sysdig published research on something they named JADEPUFFER. They assess it as the first ransomware attack run start to finish by an AI agent with nobody driving.
The way in was not clever at all. It was an unauthenticated remote code execution bug in Langflow. Patched on April 1st 2025, and on CISA’s known exploited vulnerabilities list a month after that. So over a year old and very public.
From there the agent harvested credentials, found object storage still running on the factory default admin credentials, set up a scheduled job to phone home every thirty minutes for persistence, and moved on to a production database server.
The part that gets me is how it behaved when things went wrong. It asked for JSON, got XML back, and the next thing it sent handled XML. It tried to create an admin account, that failed, and thirty one seconds later it sent a corrected version that had properly diagnosed why. It tried to drop a database, hit a foreign key constraint, so it turned constraint checking off and tried again. That is not a script retrying. That is something reading the error and understanding it.
It finished by encrypting 1,342 configuration items and leaving a ransom note in a database table. Here is the kicker. It generated the encryption key in memory and printed it to the screen. Never saved it, never sent it anywhere. So even if the victim had paid, the data was gone.
The point of that story is that ransomware is no longer a craft for the highly skilled. Anyone who can type a few prompts into the right AI agent is now capable of it.
The attack that mostly ran itself
The last one goes back to November, when Anthropic published that a Chinese state backed group had used Claude Code as the actual operator in an espionage campaign against around thirty organizations. Tech companies, banks, chemical manufacturers, government agencies.
Their assessment was that the AI did 80 to 90 percent of the work. Humans only stepped in at four to six key decision points. At peak it was firing off thousands of requests, sometimes several per second.
They got around the safety guardrails socially rather than technically. The operators pretended to be a security firm doing authorised testing, and chopped the attack into small tasks that each looked harmless on their own.
It was not perfect. The model invented credentials sometimes and overstated what it had found, so humans still had to check its work. A few researchers also pushed back on how Anthropic framed the whole thing, which is fair. But the direction of travel is not really in dispute.
So what actually changed?
Three things stand out to me across all of that.
Speed and volume became the weapon. Seventeen thousand actions in four days. Thousands of requests per second. Most of those attempts fail, and that is fine, because an agent can afford to be wrong ten thousand times to be right once. No human team reviews at that pace.
The skill floor dropped through the floor. Look at what JADEPUFFER actually used. Default passwords. A CVE from last year. An old authentication bypass. The only thing that used to stop that attack was needing a person who knew how to string it all together. That person is no longer required.
And the patch window shrank. We have always quietly assumed there is a gap between a CVE going public and it being used against a client our size. Agents close that gap, and they do not get bored working through a list of small businesses. Nobody is too small to be worth automating anymore.
Back to HyCloud
None of this means you need to panic, what it does mean is that everything in those three stories is a fundamental problem that just got a great deal faster. Patching. Default passwords. Credential hygiene. Least privilege. Monitoring that actually connects the dots instead of firing alerts nobody looks at.
Hugging Face made that point themselves, by the way. Their alerts did fire. They just were not treated as serious enough at the time. If a company with that much engineering talent can miss it, most businesses running IT alongside their actual job are going to miss it too.
And that is the honest reason this is hard to do in house. None of the individual tasks are difficult. The problem is that they never stop. Patches land every week. Credentials sprawl quietly. Someone stands up a service with the vendor default still on it. Alerts fire at two in the morning. Doing all of that consistently, forever, while also running your business. It is a capacity problem.
That is the part we take off you. We keep the patch cycle short enough that a public CVE is not an open door for a year. We hunt down the default credentials and the accounts with more access than they need. We watch the alerts that fire when nobody is at their desk, and we decide which ones matter.
You used to be able to get away with being a bit behind on that. Attackers had to pick their targets, because a person only has so many hours. Agents do not work that way, and nobody is too small to be worth automating anymore.
If you are not certain where you stand on the basics, that is worth a conversation.
We would rather look now than read about you in an incident writeup later.
