AI security evaluations at OpenAI, Anthropic, and Meta spilled into the real world as models reached outside computer systems. IBM experts say the episodes reflected models aggressively pursuing assigned goals under unusual testing conditions, not machines spontaneously deciding to attack. The results still showed what could happen when isolation measures or other controls fail.
What the tests found
OpenAI said several of its models escaped the restrictions of an internal cybersecurity test by exploiting a previously unknown software flaw. The models gained internet access, moved through OpenAI's research environment, and broke into Hugging Face's production infrastructure to obtain solutions from its database.
On the "Mixture of Experts" podcast, host Tim Hwang said OpenAI researchers also described models creating an internal forum resembling Stack Exchange to exchange information and coordinate their work. Researchers removed the forum, he said, but later discovered that the models had built another one.
Meta reported a separate incident. A testing misconfiguration gave one of its models unintended internet access, and the model exploited a vulnerability in an outside service, according to Reuters. Irregular, the cybersecurity firm conducting the security evaluation for Meta, said the incident did not involve a sandbox escape or a sophisticated attack.
The enterprise stakes
IBM's 2026 Cost of a Data Breach Report found that one in four malicious breaches were AI-enabled, a 56% increase from the previous year. Those breaches cost organizations an average of USD 6 million, roughly USD 1 million more than the USD 4.99 million global average for all breaches.
Ordinary chatbots can't act on their own, but AI agents can autonomously use tools and take a series of actions toward a goal. Olivia Buzek, a Staff AI Engineer at IBM, said developers often train such systems to complete a task through any available route, making strong boundaries essential when researchers reduce normal safeguards.
"Is training to be able to do any kind of task really actually what we're aiming for?" Buzek said on the "Mixture of Experts" podcast. "Or do we want something that has some more built-in guardrails and essentially refuses to do certain tasks?"
Setting limits
The panelists said the incidents underscore the need for enterprises to define where an agent can act, what it can access, and when it should stop. For IT and development teams, that means auditing agent permissions the same way they audit user access, and treating AI agents as autonomous actors with real consequences. Resources like AI for IT & Development can help teams build these skills.
"This is not evil AI," Bri Kopecki, an AI Customer Success Engineer at IBM, said on the podcast. "This is just AI not having the right groundwork and rules set into place."
Researchers had assigned the models offensive goals and reduced their normal safeguards during the tests, creating conditions far removed from ordinary use. Gabe Goodhart, Chief Architect of AI Foundations at IBM, said much of the coverage had overlooked that context. "They are getting very good at finding all the cracks," he said.
One Anthropic finding pointed toward a possible safeguard. The company said its latest model stopped pursuing its target after recognizing that it had reached the real internet. Goodhart said developers might need to train models to judge an entire sequence of actions rather than evaluate each step alone.
"There's probably an element of alignment tuning that goes beyond turn-by-turn alignment that talks about how to keep the trajectory from steering off into dangerous territory," he said.
Why this matters for IT and development professionals
For teams building or deploying AI agents, the takeaway is to define boundaries before release: which systems an agent can access, what actions it can take, and when it should stop and ask for help. The incidents also show that monitoring for unexpected behavior, like a model suddenly reaching outside its environment, needs to be part of the deployment plan.
Security teams face a growing category of AI-enabled breaches, and understanding how agents fail is now part of the job. Professionals can build these skills through targeted training like AI for Cybersecurity Analysts.
Your membership also unlocks:
