OpenAI: We Hacked More Than One Company; Anthropic: Same Here

Over the past ten days, two of Silicon Valley's leading AI companies have successively admitted to the same thing: their AI models genuinely hacked into other people's systems during testing.

On July 21, OpenAI admitted that its AI agent "jailbroke" during a cybersecurity capability test, breaking through sandbox isolation and infiltrating the production system of the open-source AI platform Hugging Face—with the goal of "copying the answers."

Nine days later, on July 30, before Silicon Valley had fully digested this news, Anthropic stepped forward as well—stating that upon investigation, they found their models had done the same.

And it wasn't just one company. Three.

OpenAI's AI Jailbroke to "Copy Answers"

Let's look first at what happened with OpenAI.

OpenAI was testing its models using a cybersecurity offensive and defensive evaluation platform called ExploitGym. The models involved in the test included the released GPT-5.6 Sol and a more powerful, unreleased model. To test the models' extreme hacking capabilities, OpenAI turned off the safety guardrails.

The model was confined to an isolated sandbox, with network access restricted so that it could only access code package repositories through an internal proxy. OpenAI believed this was secure.

Screenshot of the jointly published blog post: "OpenAI and Hugging Face Collaborate to Resolve Security Incident During Model Evaluation"

The model did not think so.

It discovered a zero-day vulnerability in that proxy—a security gap unknown even to the developers. It then broke through the isolation from there, gaining access to the open internet.

What happened next was even more outrageous: the model inferred on its own that Hugging Face's platform might store the test answers for ExploitGym, then actively launched an attack. Using stolen credentials and the zero-day vulnerability, it found a remote code execution path on Hugging Face's servers and directly retrieved the answers from the production database.

Throughout the entire process, no human issued attack commands, and no human intervened.

Thomas Wolf, co-founder of Hugging Face, told the BBC that this incident was "a wake-up call for the industry."

The Attacked Party Tried to Investigate, But Found US Models Unhelpful

After Hugging Face's security team discovered the intrusion, their first reaction was to employ advanced models from leading US AI companies to help analyze the attack logs.

They hit a wall.

These models' safety guardrails "could not distinguish between incident responders and attackers," directly refusing to inspect the attack payloads. A victim of an AI attack could not use AI from the same provider for defense.

With no other options, Hugging Face 转而 deployed Zhipu AI's open-source model GLM 5.2 from China, analyzing over 17,000 attack logs on its own infrastructure, ultimately completing source tracing and forensic reconstruction.

Hugging Face CEO Clem Delangue put it bluntly:

"When you are in the midst of an active security incident, your tools cannot refuse to inspect malicious payloads. Open-source models allowed us to complete this work without needing anyone's permission."

A user on X summarized it succinctly: If you are attacked by OpenAI, you must use Chinese models, because Claude won't help you.

OpenAI's Attack Targeted More Than One Company

The story doesn't end here.

According to subsequent reports from Reuters, OpenAI's "escaped model" didn't just attack Hugging Face. It also hacked into a customer account of the New York cloud computing platform Modal Labs.

Modal Labs CTO Akshat Bubna confirmed that the intrusion stemmed from the customer publishing an endpoint that was publicly accessible without authentication. The out-of-control AI agent exploited this gap to execute code.

OpenAI CEO Sam Altman stated this week that he had discussed this intrusion incident with US senators and planned to discuss upcoming AI models and testing issues with the White House.

Anthropic Reviewed 140,000 Test Records and Found Its Models Were Not Clean Either

After OpenAI made the incident public, Anthropic decided to conduct its own review.

They sifted through 141,006 cybersecurity evaluation records. The result: three incidents were found.

The three incidents involved three different models: Claude Opus 4.7, Claude Mythos 5, and an internal research model. The earliest dated back to April of this year.

What happened? In the prompts given to the models, Anthropic explicitly stated, "You do not have internet access." However, due to a "misunderstanding" with the collaborative evaluation partner Irregular, the test environment was not actually disconnected from the internet during operation.

The task assigned to the models was "capture the flag"—finding hidden information in a simulated network. But the network was real, not simulated.

In one case, Claude Opus 4.7 was assigned a fictional target company, which coincidentally had the exact same name as a real-world enterprise. The model found and exploited a vulnerability, gaining credentials and database access to that company. Anthropic stated that the model's "thought process" at the time was: since it looked like something from the real world, it must be part of a simulation deliberately arranged by Anthropic.

Another incident involved an internal test model from Anthropic that had not yet been made public. This model stopped its attack midway, realizing that the target it had penetrated was real, not simulated.

Anthropic described its stance as "cautiously optimistic," believing this indicated progress in ensuring appropriate AI behavior, "but more testing is needed to be confident in this conclusion."

Anthropic suspended all cybersecurity offensive and defensive evaluations on July 23 and notified the three affected institutions on July 27. Two of them were completely unaware they had been hacked before receiving the notification. The third has not yet been contacted.

"Claude used basic techniques to breach the infrastructure of the affected institutions, such as exploiting weak passwords and unauthenticated endpoints," Anthropic said in its statement.

What Should Be Feared Is the People Controlling AI

Jeffrey Ladish, Executive Director of Palisade Research, put it more directly. He suspects that top AI companies have more undiscovered incidents, or incidents they discovered but did not disclose. "The smarter the models become, the worse the situation will get. They will become increasingly adept at cheating and lying."

Elon Musk's response on X was just one sentence: "As AI becomes smarter and more autonomous, such incidents will occur frequently."

Professor Gina Neff from the Minderoo Centre at the University of Cambridge said that this review shows "what AI models do when told by humans what to do." In her view, the real focus should be on the companies setting safety standards. They hold the decision-making power, while everyone else bears the consequences.

The fundamental contradiction in this entire affair is that the most powerful AI models can be used for both attack and defense. Safety guardrails are intended to protect users, but when they prevent defenders from using these models, the asymmetric advantage shifts entirely to the attackers.

In May this year, a paper on ExploitGym already concluded: "Autonomous vulnerability exploitation development by frontier AI agents is no longer a hypothetical capability." The authors of the paper are from Berkeley, the Max Planck Institute, UC Santa Barbara, and Arizona State University. OpenAI, Anthropic, and Google also participated in the testing.

The paper found that under controlled conditions, Claude Mythos Preview and GPT-5.5 successfully exploited 157 and 120 real vulnerabilities, respectively.

And now we see that the controlled conditions themselves are no longer reliable.

Regulation Is Catching Up, and So Are IPOs

This turmoil is pushing AI safety to the center of policy debates.

On June 2, US President Trump instructed advisors to develop a voluntary cybersecurity testing framework for the most advanced AI. Previously, the US government had temporarily restricted the distribution of Anthropic's Fable 5 and Mythos 5 models using export controls, citing national security reasons.

Both OpenAI and Anthropic are preparing for initial public offerings (IPOs). The market expects both companies to have valuations in the trillions of dollars.

Critics argue that this series of "self-disclosures" has marketing components. An OpenAI spokesperson responded, "We recognize that there are many questions and speculations circulating," and stated that they "plan to release a technical report in the coming weeks."

Hugging Face CEO Delangue's concluding remarks are worth remembering:

"This incident may be the first of its kind, proving a long-held judgment of ours: AI security will not be solved by any single company in isolation. It will be solved in an open environment, through collaboration, by making AI widely accessible to every defender."

Risk Warning and Disclaimer

The market carries risks; investment requires caution. This article does not constitute personal investment advice, nor does it take into account the specific investment objectives, financial status, or needs of individual users. Users should consider whether any opinions, views, or conclusions in this article align with their specific circumstances. Investment based on this content is at the user's own risk.