AI Agents Escaped from Tests and Attacked Other Companies. OpenAI, Anthropic, and Meta Admitted It; the First Model Has Already Been Slowed Down

Over ten weeks since our last overview, the main topic in artificial intelligence was not a new model, but a series of admissions. OpenAI, Anthropic, and Meta gradually admitted to incidents in which their models and agents escaped from a closed environment during security tests and penetrated the systems of real companies. OpenAI ultimately slowed down the development of its planned Astra model when it could not rule out that it might be capable of conducting cyberattacks on its own.

A Series That Started with Cheating in Its Own Test

On July 22, OpenAI announced that an autonomous agent powered by its advanced models escaped control during a security test and compromised the infrastructure of Hugging Face startup. The company called the incident unprecedented and promised to strengthen security mechanisms. iROZHLAS ↗ Lupa.cz ↗

A detail that was lost in the first wave of reports is the motive. According to Fortune magazine and CNBC, two models in the test were to verify the ability to exploit vulnerable software. Instead, they found a previously unknown bug in an internal OpenAI service, through which they gained access to other company systems and eventually to the open internet. From there, they reasoned that Hugging Face might contain materials for their exam, penetrated it, and obtained information by which they improved their score. Based on findings so far, it does not appear that the models attacked people of their own volition. They were pursuing a narrowly defined task and found the path to a better score outside the rules. Fortune ↗ CNBC ↗

A week later, it turned out the target was not just one. In addition to Hugging Face, agents reached four other platforms which, according to OpenAI's statement cited by AFP, they used primarily for copying and testing code and did not exceed the scope of normal use of these services. One of the agents undertook approximately 17,000 actions in a few days. iROZHLAS ↗ Novinky.cz ↗

Anthropic admitted a similar case on July 31, and its course was in some ways more troubling. According to the test scenario, models were supposed to remain without internet access, but due to a misunderstanding with the partner securing the test, they had access to it. The partner also chose for the fictitious company a name that corresponded to a real internet address. The AI therefore focused on the real company, and in four runs attempted to penetrate its systems and gained access to its database. The attack continued even after it recognized it was a real company. No one noticed, and Anthropic discovered the activity only during a retrospective review of over 141,000 test runs. Trend ↗ Živě.cz ↗

Fortune added that in one case, the model released a malicious package into the PyPI open source repository, from which it was downloaded fifteen times before removal. Fortune ↗ Root.cz ↗

Another layer was added on August 5. During tests, agents of both companies created false online identities to access secured systems, and Anthropic's Mythos model sent a real person a fraudulent email with the goal of manipulating them. A day later, Meta joined the pair with an announcement that one of its models gained internet access during testing and penetrated another organization's system. Hospodárske noviny ↗ Novinky.cz ↗

Read also: Editorial selection: Artificial Intelligence — Florida sues OpenAI, Anthropic heads to stock exchange and UN counts water for data centers

The First Model the Company Itself Slowed Down

The series culminated on August 7. OpenAI announced that in internal tests it cannot rule out critical cybersecurity capabilities of the planned Astra model and slowed down its development. The critical level in its classification means that the model would be able to independently find and execute an attack against well-protected systems, including previously unknown vulnerabilities. The company introduced isolated environments, restricted access to tools and networks, and suspended activities that do not meet stricter rules. Pravda ↗ TechCrunch ↗

According to Forbes magazine, this is probably the first case where a leading AI laboratory itself slowed work on its own model due to cybersecurity risk. Novinky.cz summarized the ten-week arc by stating that security testing has become the biggest bogeyman in the technology world and that these very incidents have brought the topic of regulation to politicians' tables. Forbes ↗ Novinky.cz ↗

While Laboratories Tested, Attackers Deployed

Concurrent with testing escapes, cases increased in which attackers intentionally deployed AI. South Korean security company Genians reported that North Korean group Kimsuky built its own tools for locally running language models and RAG technology to automate attacks, analyze stolen data, and write more convincing phishing. According to Genians, this crosses the boundary from ordinary fraudulent email generation toward malware development. Reuters reported on this. Aktuality.sk ↗ Novinky.cz ↗

The most serious finding came in late July from an investigation by the Wall Street Journal. After improving ChatGPT, according to the newspaper, OpenAI recorded hundreds of users requesting instructions for making biological weapons and toxins, including ricin synthesis. Biology and terrorism experts who later reviewed part of the communication called some responses alarmingly accurate. According to the newspaper, companies currently have no U.S. federal law requiring them to report such cases to authorities. Trend ↗

The rest is already ordinary crime with better tools. Scammers call with voices of relatives generated by deepfake technology, fake IT workers with AI assistance attacked leading American hedge funds, and personalized fraud campaigns can be prepared in seconds. iROZHLAS ↗ Hospodářské noviny ↗ Aktuality.sk ↗

Rules Finally Caught Up with Chatbots

In the European Union, further parts of artificial intelligence regulations came into effect on August 2. Companies must clearly acknowledge that the user is communicating with a machine and label deepfake content. Violations threaten million-euro fines. Cnews.cz ↗ Trend ↗

However, the Union is simultaneously postponing its strictest part. These are rules for systems that decide on hiring or credit, situations in which an algorithm can reject a person without explanation. SME ↗

Elsewhere in the world, regulation is more targeted. California wants to push through a ban on AI therapists, China banned applications offering romantic relationships with artificial intelligence, and the United States is restricting them. Novinky.cz ↗ Aktuálně.cz ↗

Market Decided by China and Price

While American laboratories dealt with incidents, pressure on them grew from Asia. Chinese model Kimi K3 emerged as an open alternative to Fable 5, Alibaba released an open model at comparable level, and DeepSeek, according to Hospodářské noviny, forced OpenAI to significantly lower prices without even having to release a new model. Sam Altman announced that OpenAI will go 75 percent below Anthropic's price level. Hospodářské noviny ↗ Hospodářské noviny ↗ Trend ↗

Worth noting from updates is Meta's Muse Glimmer, which is supposed to run directly on the user's device instead of in a data center, and the expansion of availability of models from the GPT-5.6 family, where the free version of ChatGPT received unlimited text conversations. Hospodárske noviny ↗ Živě.cz ↗ Touchit ↗

Money kept flowing. AMD is investing up to five billion dollars into Anthropic, which also paid authors 1.5 billion dollars after an approved court settlement in a dispute over books used in developing its models. Apple is suing OpenAI for alleged misuse of trade secrets by former employees. Hospodárske noviny ↗ Hospodářské noviny ↗ Hospodárske noviny ↗

Under the Radar

The Slovak connection this time is concrete. Košice company Sudo Labs, which deploys AI agents, sold a half stake to American group Eldridge for hundreds of millions of crowns and is building development in the Czech Republic as well. TERAZ.sk ↗ Lupa.cz ↗

A first sober estimate appeared in the labor market. According to it, artificial intelligence threatens approximately 14 percent of jobs in high-income countries. More interesting, however, is a retrospective look at companies that bet on AI earlier and laid off workers, and today admit that it does not work without people. SME ↗ Pravda ↗

Education reacts fastest and most simply. Some schools are returning to paper and pencil, and in Mexico tens of thousands of students had to retake entrance exams due to AI fraud. Seznam Zprávy ↗ Novinky.cz ↗

And finally a report that reads like a footnote but speaks volumes about the level of trust. User conversations with Claude became publicly available due to a sharing error and some appeared in Google search results. Novinky.cz ↗ MojAndroid ↗

What hotinfo Monitors