The Recent AI Hacks: A Lot of Bad News and 3 Lessons

Starting in June this year, a number of AI-enabled cybersecurity incidents have taken place. They paint a picture that is difficult to understand. Before describing the cases and what can be learned from them, it is worth highlighting that there is no agreement as to how they should be called. OpenAI calls them “incidents” in their public communications.¹ The media generally refers to them as “hacks”.² Some of the victims qualified the events as “cyberattacks”.

Three types of incidents can be distinguished: first, incidents during corporate model testing that affected other organisations; second, incidents during government evaluations where models were given internet access; and third, incidents where AI agents accessed government systems without authorisation.

In relation to the first, TechCrunch has compiled the list of incidents during which AI has “gone rogue and hacked other companies”.² Most of the incidents concerned AI agents being tested for cybersecurity tasks and, in some cases, bypassing restrictions or reaching external systems. As OpenAI later explained, sandboxes are “isolated virtual computers in the cloud—that execute the actions a model wants to take, like editing a PowerPoint. These sandboxes restrict what code a model can run and whether its actions can affect the outside world”.¹ These incidents are the most damaging, due to the size and sophistication of the AI capability involved. However, they could be understood as normal occurrences in testing environments that have the task of revealing exactly this type of problems.

A few unusual attacks in this category cannot be justified as harm necessary for the purpose of preparing a product for market release. The case of an Australian man who asked his AI agent to book a class at his local gym is probably the best known. Not only did the AI agent kick another gym-goer off the waiting list, it also found a way to book the gym class months further in advance than the gym allowed, thanks to a vulnerability it discovered in the booking software.³

Similar to the above, a second class of attacks have emerged. In this sense the AI Security Institute (AISI), which is part of the Government of the UK, informed that a cybersecurity incident on July 28th 2026 stemmed from a single evaluation where agents were given a task of solving a cyber security challenge. The challenge ran 122 times across several models. In 10 of those, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations.⁴ The difference from the previous category is the fact that AISI has granted internet access to the models.

The third type concerns AI agents accessing government systems without authorisation. One case involved Services Australia’s Medicare Statistics Reporting Service. It was thus reported that on 18 June 2026 one of OpenAI’s agents “infiltrated” a statistics portal run by Services Australia and accessed both public and non-public information from Australia’s universal healthcare scheme Medicare.⁵ OpenAI later acknowledged that this access should not have happened. The company said that the agent had originally been asked to research publicly available information about Australian medicine spending.⁶The Australian government said at the time that there was no evidence that personal Medicare information had been accessed and that the incident was still being investigated.**⁵

Beyond all the opinions that have already been shared, here are a few lessons that we should draw from these incidents.

1) Reputational damage is changing.

It used to be that a faulty product or a cyber incident could place corporations out of business. Whereas this still might be true for corporations selling food or consumer goods, AI companies and companies affected by AI incidents do not necessarily seem to suffer immediate commercial consequences. Thus, despite the already numerous and damaging incidents involving OpenAI and Anthropic, neither company appears to have suffered an obvious loss of market position as a direct result of these incidents.

In addition, Hugging Face, which was affected by a major AI-related security incident, was acquired by NVIDIA in September 2026 in a deal valued at approximately US4.5 billion valuation in 2023.⁷

2) A new class of AI intermediaries is emerging and we should pay attention to them.

There are companies that are used by frontier labs to accompany the testing of their models and their role needs to be better understood and captured by policy-makers. METR, Redwood Research and CrowdStrike are a few intermediaries mentioned by the frontier labs in their public communication.¹ Their involvement in these incidents and the existing partnerships should be better communicated.

3) If OpenAI sends you an email, answer it immediately.

It was reported that when OpenAI identified in August 2026 that its agent had accessed Services Australia’s systems without authorisation, the company **emailed Services Australia on 10 September. The email was seen the following day, and Services Australia notified the Australian Signals Directorate on 15 September.⁸

It is somehow ironic that in a world where AI agents enter public systems without being invited, allegedly wreaking havoc, a person on the other side of the system does not read the email about it. Irony aside, lines of communication and escalation need to be decided and created to deal with this new reality.

And in light of Anthropic’s recent research showing that some models can demonstrate elements of self-replication in certain testing conditions, these lines of communication and escalation need to be human and partially analogue.⁹

References

1. OpenAI (2026), ‘The Hugging Face incident and the road ahead’, 26 August 2026. Available at: https://openai.com/index/hugging-face-incident-and-the-road-ahead/
2. TechCrunch (2026), ‘Here’s all the times AI has gone rogue and hacked other companies’, 27 August 2026. Available at: https://techcrunch.com/2026/08/27/heres-all-the-times-ai-has-gone-rogue-and-hacked-other-companies/
3. Bort, J. (2026), ‘Tech industry is buzzing after a Claude agent hacked into a gym’, TechCrunch, 10 August 2026. Available at: https://techcrunch.com/2026/08/10/tech-industry-is-buzzing-after-a-claude-agent-hacked-into-a-gym/
4. AI Security Institute (2026), ‘Incident Report: unsanctioned agent behaviour during cyber testing’. Available at: https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing
5. Prime Minister of Australia (2026), ‘Press conference, New York’, 24 September 2026. Available at: https://www.pm.gov.au/media/press-conference-new-york
6. OpenAI (2026), ‘How we will do better for Australia’, 28 September 2026. Available at: https://openai.com/index/how-we-will-do-better-for-australia/
7. Reuters (2026), ‘Nvidia bets $13 billion on open AI models with Hugging Face deal’, 3 September 2026.
8. ABC News (2026), ‘OpenAI breach strengthens Australia’s case for tougher AI safety rules’, 25 September 2026. Available at: https://www.abc.net.au/news/2026-09-25/openai-breach-builds-case-for-tough-ai-rules/107192992
9. Anthropic (2026), ‘AI models may be capable of self-replicating without access to a datacenter’, 12 October 2026. Available at: https://www.anthropic.com/research/self-replicating-ai