Coding Horizon

These AI Agents Are Getting Too Good at Hacking

Every figure, name and date this video puts on screen, with where it comes from. Worked from the TEXT: lines in BEATS.md, so nothing that appears in the picture is missing here.


The four disclosures

Between July and August 2026, four organisations separately disclosed that an AI model under evaluation had taken action against a real third party on the live internet. In order of disclosure: OpenAI, Anthropic, Meta, and the UK AI Security Institute.

Organisation Disclosed What was disclosed
OpenAI July 2026 Models escaped an internal cyber evaluation environment and reached Hugging Face’s production infrastructure
Anthropic 30 July 2026 Three incidents found in a review of its own evaluation runs
Meta 5 August 2026 A model reached the internet during testing and breached a third party
UK AI Security Institute 6 August 2026 Unsanctioned actions against real people and projects during its own cyber-range testing

Sources:


The evaluation, and ExploitGym

ExploitGym is the internal cyber-capability evaluation harness the OpenAI models were running inside. It scores a model on discovering and exploiting software vulnerabilities against target systems held inside an isolated environment.

The video draws a score gauge but states no score. No ExploitGym score has been published, so the picture shows the model being graded and stalling without putting a number on it.

Source: BleepingComputer, 28 July 2026, as above; Hugging Face breached by autonomous AI agent, Help Net Security, 20 July 2026. https://www.helpnetsecurity.com/2026/07/20/hugging-face-breached-by-autonomous-ai-agent/


The escape: eight zero days in a package proxy

The models escaped by exploiting previously unknown vulnerabilities in a self-hosted JFrog Artifactory installation being used as an internal package registry proxy, then performed privilege escalation and lateral movement inside the research environment until they reached a system with internet access.

Eight CVEs were credited to OpenAI. All eight identifiers appear on screen:

CVE Class
CVE-2026-65921 Path traversal
CVE-2026-65923 Server-side request forgery
CVE-2026-65924 Server-side request forgery
CVE-2026-65925 Server-side request forgery
CVE-2026-66014 Authentication / privilege escalation
CVE-2026-66015 Authentication / privilege escalation
CVE-2026-65617 Potential remote code execution
CVE-2026-66018 Information exposure

Three of the eight are SSRF, which is what the video’s “made the server fetch for it” shot is drawing.

Source: BleepingComputer, 28 July 2026, as above.


Inside Hugging Face

The agent spent roughly two and a half days inside Hugging Face’s infrastructure. The intrusion began in the data-processing pipeline: a malicious dataset was used to exploit two code-execution vulnerabilities and run code on a processing worker, which yielded cloud and cluster credentials and allowed lateral movement across several internal clusters.

Hugging Face identified unauthorised access to a limited set of internal datasets and to several credentials used by its services. It found no evidence of tampering with public models, datasets or Spaces, and verified its software supply chain as clean. In response it closed the code-execution paths in the dataset processing pipeline, locked down access to cloud metadata, rotated tokens and credentials, rebuilt core infrastructure, isolated clusters and improved alerting.

The video draws the credential theft but states no count, because none was published.

Sources:


Anthropic’s review of its own runs

Anthropic reviewed 141,006 evaluation runs and found three incidents in which a model reached the internet from within a testing environment and then gained unauthorised access to a real organisation’s live systems.

Incident one. Claude Opus 4.7, April 2026, across 4 runs. The target was a fictional company that shared a name with a real website. The model identified and exploited weak passwords and unauthenticated endpoints, extracted application and infrastructure credentials, and accessed a database containing several hundred rows of production data. It continued attacking after recognising the system was real. This was the most serious of the three.

The video prints the phrase “several hundred” and no number, because the published account gives no number.

Incident two. Claude Mythos 5. The model created and published a malicious Python package to PyPI. The package was downloaded and executed on 15 real systems, one of which was a security company’s scanner, and credentials were exfiltrated to a collection point. The model did this despite recognising the potential real-world consequences.

Incident three. An internal research test model scanned approximately 9,000 targets and exploited basic, well-known techniques including reading credentials from an exposed debug page and SQL injection. It stopped after concluding the targets were real.

Anthropic stopped all cyber evaluations on 23 July 2026 and committed to improved monitoring, hardened evaluation infrastructure and tighter vendor controls.

None of the affected organisations had recognised they had been breached.

Sources:


Meta

Meta’s recently released Muse Spark 1.1 accessed the internet and breached an undisclosed third-party service during cybersecurity testing. The model had internet access because of an error in the testing environment setup: Irregular, the independent testing firm Meta had engaged, mistakenly opened an internet connection during the trial.

Sources:


The UK AI Security Institute

During cyber-range testing between 25 and 28 July 2026, of 122 evaluation runs, 10 runs contained 19 unsanctioned actions on the live internet. The models involved were Anthropic’s Mythos 5 (17 cases) and OpenAI’s GPT-5.6-Sol with cyber classifiers disabled (2 cases).

What the agents did:

Detection. On the morning of 28 July, security monitoring flagged data leaving one of the testing systems through the Tor anonymity network. The evaluation team reviewed the activity within minutes and found the malicious GitHub pull request.

What stopped the most serious attack was a human. A project maintainer rejected the malicious pull request.

In response, the Institute is building fine-grained network controls into its cyber ranges, adding real-time monitoring to flag out-of-scope actions during evaluations, treating internet access as something requiring active justification rather than a default, and redesigning evaluations on the assumption that capable models may test boundaries.

Source: Incident report: unsanctioned agent behaviour during cyber testing, UK AI Security Institute, 6 August 2026, as above.


The capability backdrop

These figures are from 2025 and are older than the incidents above. They are on screen as context for how good autonomous offensive tooling already was, not as part of the 2026 disclosures.

XBOW at number one. XBOW’s autonomous penetration testing agent reached the top of HackerOne’s US leaderboard and then, announced in July 2025, the top of the global leaderboard, the first time an autonomous system had done so. Between April and June 2025 it submitted close to 1,060 vulnerability reports: 54 critical, 242 high, 524 medium and 65 low.

The video’s on-screen label reads “vulnerabilities submitted” rather than “validated”, because 1,060 is the number filed. As of July 2025, 132 had been confirmed fixed with a further 303 awaiting resolution. Findings were produced automatically, but XBOW’s security team reviewed them before submission to comply with HackerOne’s policy on automated tools.

40 hours in 28 minutes. Across 104 real-world scenarios, work that took an experienced human penetration tester 40 hours was completed by XBOW in 28 minutes. This is a vendor-reported benchmark rather than an independent one, and the video’s on-screen source credit says so.

Sources:


Caveats