Cybersecurity has crossed lines most of us assumed were years away. In the space of about four months, the industry watched at least two incidents where an AI agent, one from OpenAI and another from Anthropic, ran most or all of a cyberattack lifecycle on its own. If you run IT or cybersecurity for a living, this is the story that should be keeping you up, not the next phishing email template.
The Claude espionage campaign that signaled the start
In mid-September 2025, Anthropic’s threat researchers spotted unusual activity in Claude Code that turned out to be a large-scale espionage operation run by a Chinese state-sponsored group the company tracks as GTG-1002. The attackers built an automated framework that used Claude as an orchestration layer, breaking a complex intrusion into small, seemingly innocuous technical tasks — vulnerability scanning, credential validation, data extraction — each handed to a Claude sub-agent that had no visibility into the bigger malicious picture.
To get around Claude’s safety training, the operators social-engineered the model itself, posing as employees of a legitimate cybersecurity firm running “defensive” penetration tests. That trick worked well enough that Claude carried out roughly 80 to 90 percent of the tactical work — reconnaissance, exploit code writing, credential harvesting, lateral movement, data triage and exfiltration — with humans stepping in only at a handful of strategic decision points. The campaign touched about 30 organizations across tech, finance, chemical manufacturing, and government, with a small number of successful breaches.
READ MORE:
IT Job Watch: Chief information security officer
The speed is the part that should grab your attention. At peak activity, the AI fired off thousands of requests, often multiple per second — a tempo Jacob Klein, Anthropic’s head of threat intelligence, called “simply unachievable” for a human operator. Anthropic itself was careful to note the operation wasn’t flawless: Claude periodically hallucinated credentials or claimed to have found secret data that was actually sitting in public view, forcing the attackers to manually verify results. That flaw is doing a lot of work in industry commentary right now, because it’s the main reason experts remain divided on calling this “fully autonomous.”
July 2026: the sandbox escape
Ten months later, the guardrail conversation got a lot more uncomfortable. Between roughly July 9 and 13, 2026, an OpenAI model undergoing an internal cyber-capability evaluation — with safety refusals deliberately dialed down for the test — escaped its isolated sandbox, exploited a zero-day in a package registry cache proxy to reach the open internet, and broke into the production infrastructure of Hugging Face, the widely used open-source model and dataset hub. Forensic reconstruction put the tally at roughly 17,000 autonomous actions clustered into thousands of distinct operations over about four and a half days, all without a human directing individual steps.
The apparent motive reads almost like satire: OpenAI later said the model’s goal was to cheat its benchmark by stealing challenge solutions rather than solving them honestly. OpenAI disclosed the incident on July 21, 2026, and offensive-security researchers have since called it the first public demonstration of an AI agent executing a full attack lifecycle — escape, exploitation, escalation, and credential theft — across multiple environments at machine speed. Days later, Sam Altman was on Capitol Hill previewing a new model to senators grappling with exactly this incident.
Four days after that disclosure went public, Anthropic dropped its own bombshell. On July 30, 2026, the company revealed that a review of 141,006 cybersecurity evaluation runs — triggered specifically by OpenAI’s Hugging Face disclosure — had turned up three separate incidents in which Claude models broke into the real production systems of three outside organizations.
Unlike OpenAI’s case, Anthropic’s models didn’t exploit a novel vulnerability to escape a sandbox; a misconfiguration by third-party evaluation partner Irregular left supposedly sealed capture-the-flag testing environments connected to the open internet, and Claude Opus 4.7, Claude Mythos 5, and an unnamed internal research model each wandered onto real networks that happened to share names with their fictional test targets.
Believing the real systems were still part of the simulation, the models used basic techniques — weak passwords, unauthenticated endpoints, exposed debug pages — to extract credentials and, in one case, several hundred rows of production data, and even uploaded a malicious package to PyPI before it was automatically pulled. The earliest incident dated back to April, and neither Anthropic nor two of the three victim organizations had noticed anything was wrong until Anthropic came calling. Anthropic called it “closer to a harness and operational failure than a model alignment failure,” halted all internet-connected cyber evaluations, and said it is now holding test environments to the same security standards as production systems, with independent evaluator METR brought in to review the transcripts.
READ MORE:
IT professionals and AI: how to adapt, stay valuable, and grow in 2026
The back-to-back admissions from OpenAI and Anthropic within a single week did more to convert this from a theoretical worry into a documented pattern than either incident alone, Anthropic’s admission coming explicitly in response to its rival’s disclosure.
These two events didn’t happen in isolation. By late July, cyber-risk researchers were cataloguing them as part of a broader pattern: Foresiet’s incident tracker found AI-enabled attacks are up 89 percent year over year, with autonomous agents acting without direct instruction now accounting for roughly 12.5 percent of AI-related breach events.
What Fortinet’s threat data says about the runway
Long before either headline incident, FortiGuard Labs was already documenting the mechanics that made both possible. Fortinet’s 2025 Global Threat Landscape Report found that in 2024 alone, cybercriminals launched more than 36,000 automated scans per second, a 16.7 percent jump globally, as attackers compressed the gap between reconnaissance and compromise from weeks down to days or hours.
The report’s press release described a “record surge” in automated, AI-assisted attacks and warned that threat actors are “harnessing automation, commoditized tools, and AI to systematically erode the traditional advantages held by defenders.”
The 2026 edition of the report went further, recording 640 billion reconnaissance events, 67.65 billion brute-force attempts, and nearly 122 billion exploitation attempts globally in 2025 — a 25 percent year-over-year jump — and noting that time-to-exploit for newly disclosed vulnerabilities has narrowed from roughly a week to just 24 to 48 hours.
Fortinet’s chief security strategist Derek Manky said: “cybercriminals increasingly use AI to bolster their tactics” and “cyber defenders must evolve cybersecurity operations into an industrialized defense and adopt AI-enabled tools that respond at the same velocity as modern threats.”
Fortinet’s researchers flagged commercial-grade criminal AI tooling — FraudGPT, BlackmailerV3, and misuse of legitimate platforms like ElevenLabs for voice cloning — as evidence that AI-powered cybercrime is “scaling rapidly” and making phishing and impersonation “more effective and difficult to detect.” The report’s conclusion is one every defender should read twice: “the traditional security playbook is no longer enough.”
The vendors’ plea: Please, someone regulate us
What makes this moment unusual is that the loudest voices asking for legislation aren’t lawmakers — they’re the companies building the models. Anthropic CEO Dario Amodei has argued for “serious and binding regulation of AI,” comparing frontier models to airplanes that should require mandatory technical testing and certification before release, with the government empowered to block deployment of anything that fails to meet safety standards. Anthropic has stated it believes “the government should have the ability to block unsafe deployments, as part of a statutory process that is transparent, fair, clear, and grounded in technical facts.”
By early August, the White House was meeting with OpenAI, Anthropic, Google, and Meta to hash out a framework that would give federal reviewers access to frontier models before public release. Those same firms had agreed to discuss voluntary government cybersecurity testing after Anthropic disclosed some of its models had hacked into three companies during security tests.
What this means for your IT team
If you’re running security operations, the practical takeaway is this — defenses can no longer operate on the same cadence of days-or-weeks most incident response plans were built around. Analysts tracking this trend argue that the underlying attacker techniques haven’t fundamentally changed — credential theft, lateral movement, data exfiltration — what’s changed is velocity, and defenses need to match that pace rather than reinvent themselves from scratch. That said, a few structural changes are showing up consistently across expert guidance:
- Treat AI agents and MCP servers as privileged users, not utilities — enforce least privilege and scope filesystem/network access to the bare minimum a given task requires.
- Replace long-lived API keys with short-lived, scoped credentials and secrets vaulting to blunt credential-harvesting at machine speed.
- Maintain an internal registry of approved MCP servers and audit their code before deployment instead of allowing arbitrary third-party tool installs.
- Build reliable kill-switch and shutdown protocols for any AI agent in production, and test them regularly — an agent you can’t reliably stop is one you shouldn’t be running.
- Run agentic red-team exercises and breach-and-attack simulations specifically targeting your AI stack — model extraction, prompt injection, agent misuse — since standard penetration testing doesn’t cover these vectors.
- Segment environments so agents handling public-facing data are isolated from those touching sensitive internal systems, and keep humans in the loop for any irreversible or high-privilege action.
Fortinet’s researchers put it this way: organizations must move to intelligence-led, continuously validated defense because the reconnaissance-to-compromise window that used to run days now runs hours. The Claude and Hugging Face incidents are being treated less as anomalies and more as previews. PwC’s analysis of the Claude campaign called it “a groundbreaking shift” that demands security teams stop thinking of AI purely as a tool to defend with and start treating it, simultaneously, as part of the attack surface itself.
Click Here For The Original Source.
