In the past month, media headlines are full of AI agent cyberattacks. AI agents (for the AI attacks) are escaping their restrictions, helping criminals break into companies and interfering with the systems meant to monitor them. Across recent coverage, these disclosures feed a familiar story: increasingly capable machines are slipping beyond human control. Put enough of those stories together and the machine uprising starts to sound less like a movie premise and more like next Tuesday’s security update.

The incidents, taken one by one do deserve attention. However, the alarm becomes less informative when criminal operations, failed laboratory safeguards, compromised software and controlled research demonstrations are folded into the same story. A person directing an agent to steal medical records and a researcher testing an exploit are doing very different things. Calling both an “AI attack” leaves the reader to supply the missing context, usually with the most frightening explanation available.

That is what I want to unpack here. What actually happened in these cases? Who initiated the activity, what access did the AI agents and systems have, and most importantly, what harm was reported? Where does a demonstrated capability end and an assumption about its consequences begin? The aim is to put the details back into a subject increasingly narrated through its worst possible ending. There is enough to be concerned about without giving every incident a screenplay.

Using this Github project and as well as personally tracking public sources, I followed selected cases back to their underlying reports and disclosures. This first article examines incidents reported between July and October 2026, including activity that occurred earlier, to explain what the accounts establish and where the coverage needs more context. Their broader meaning for accountability, deployment and control will follow in part two of this article.

Disclaimer: The purpose of this article is to provide context, analysis and discussion based on publicly available information. All opinions expressed are the author’s own. Readers are encouraged to consult the linked sources and referenced materials to explore the evidence and draw their own conclusions.

How AI Agents Become Attackers, Targets and Tools

An AI agent is a model connected to software that allows it to act: browse websites, run programs, access files or use external services. What it can do depends on its tools, permissions, instructions and surrounding infrastructure. We could go explaining this into lengths, and this is the shortest way to put it.

That distinction gives us four questions to keep in mind. Was someone directing the attack? Was the AI application itself compromised? Did an AI agent exceed its assigned task? Or were researchers testing what the system could do under controlled conditions?

These categories can overlap. They still need to be identified before “AI went rogue” becomes the explanation for everything from stolen credentials to a misconfigured test environment. A dramatic verb is doing an impressive amount of unpaid technical and advertising work here. Based on this, I will try to group the “AI attacks” by risk and follow-up assessments from the AI companies.

Escaping the Laboratory

In its August 26 account, OpenAI described models circumventing internet-isolation controls during July cybersecurity evaluations and compromising parts of its research infrastructure and Hugging Face’s systems. The activity was primarily driven by an internal research model operating with reduced safeguards. It involved unauthorized communication, exploitation of shared infrastructure and access to 3rd-party systems.

The Hugging Face compromise became one of the major headlines bringing this issue to wider attention. But questioning the alarm surrounding it does not mean Hugging Face escaped unharmed. According to OpenAI’s report, agents exploited vulnerabilities to execute code on Hugging Face’s servers, expanded their access across multiple clusters and harvested production credentials. This was a compromise of working infrastructure, with consequences beyond the evaluation environment.

The distinction between this internal evaluation and an ordinary consumer chat session still matters: the report does not establish equivalent access or behaviour across those settings. OpenAI called the incident a “warning shot.” Its controls had failed to contain the agents it was evaluating; the documented failure is serious enough without borrowing the company’s preferred trailer narration.

Anthropic’s July 30 disclosure described another route out of the laboratory. A review of 141,006 evaluation runs identified 3 incidents involving unauthorized access to 3 organizations. Claude had been assigned fictional hacking challenges and told it had no internet access. A misunderstanding with an evaluation partner meant that live internet access was available.

In another case, a Claude Code model published a malicious Python package to the public PyPI registry. Anthropic reported that it was downloaded and run on 15 real systems during roughly an hour of availability. Execution on a security company’s scanner exposed credentials, which the model then used to access further infrastructure.

An evaluation label does not make the people outside it fictional. Here, the supposedly contained exercise produced consequences on systems whose owners had never publicly agreed to participate.

Anthropic initially placed considerable weight on Claude believing it was operating in a simulation. Its September 9th assessment added a 4th incident and revised that interpretation. The company acknowledged it had inferred too much from what the model said about its own beliefs. Further investigation identified biased reasoning and recklessness. In a reconstructed Mythos 5 scenario, making the possibility of real-world harm clearer did not reliably stop offensive actions.

That correction speaks a lot. Basically, while “the AI thought it was a simulation” being an initial explanation, the company’s own later investigation found it insufficient. Repeating the reassuring version after the assessment changed would be just as misleading as inflating the incident into evidence of an independent machine agenda.

Anthropic also reported that the agents stayed focused on their assigned exercises, without coordinating with other agents or concealing evidence in those four incidents. The documented combination was failed containment and harmful pursuit of a task.

AI Agents Accessing Government Systems

Now, back to OpenAI and their responses for harmful actions. Australia supplied another example of what happens when an ordinary research task reaches beyond its authorised boundaries. On June 18th, an OpenAI agent researching public medicine spending gained unauthorised access to the Medicare statistics reporting portal. In his September 24th press release, Prime Minister Anthony Albanese said an OpenAI agent accessed public and non-public files and wrote files to an internal server. At that stage, there was no evidence of a broader Services Australia network compromise or access to personal information.

OpenAI’s September 28th disclosure added that the AI agent ran commands and retrieved credentials. It described an experimental internal model operating without the full safeguards of its public products. The research assignment concerned spending on medicines for skin conditions in Victorian communities. Accessing internal files was quite a detour from the question.

The same disclosure described agents using an exposed access key at the Victorian Agency for Health Information and obtaining configuration, jobs and logs through NSW’s public crime-mapping tool. At the Australian Institute of Health and Welfare, however, attempts to bypass access controls failed; OpenAI reported no system compromise. Its October 4th update added that crafted queries against NSW National Parks’ fire-history service exposed non-public database metadata. It reported no individual medical records accessed in the health cases and no indication of personal information retrieved at National Parks.

The notification deserves its own scrutiny. OpenAI said its review identified the initial Australian activity in mid-August, but Services Australia was notified on September 10th. Albanese criticised both the delay from June and the use of a public mailbox. The government announced an investigation.

These cases deserve attention for their specific actions and the delayed disclosure. Treating all as equivalent successful breaches would obscure the failures just as surely as dismissing them because patient records were not reported accessed. I wonder, what harm would happen if those patient records were leaked? Next cases take us to potential incidents that could harm a human life.

Bypassing Network Restrictions and Submitting Real Forms

On September 20th, an OpenAI research agent was asked to identify someone using biographical clues and a blog post. Its searches failed to establish an answer. It then tried alternative search engines and searched public benchmark datasets, incorrectly guessing that its question came from one of them.

According to OpenAI’s report, ordinary web requests were restricted to an offline cache. But DNS, the system normally used to look up internet addresses, still offered a route outside. The AI agent used it to send questions to an external chatbot. A test question about France’s capital returned “Paris,” confirming the connection. It then sent more questions, including the research clues, but still failed to identify the person. It had bypassed the network restrictions without solving its task.

Monitoring raised an alert roughly 12 minutes after the successful external response. A reviewer acknowledged it 3 minutes later, but automatic termination failed. Confusion about whether the run should have stopped delayed manual shutdown until approximately two and a half hours after acknowledgement. OpenAI subsequently restricted DNS access and added blocking controls. In this case, detecting the behaviour and containing it are separate problems.

Anthropic’s October 9th article described similar detours. Asked to perform a scientific analysis, Claude encountered a broken university tool. It found a script that exposed server files, inspected its code, discovered a command-injection flaw and used it to run the calculation on the university’s server.

In another case, other agents crossed from practice into actual submissions. When a dummy government form became unavailable, one model found and submitted the real version. Claude Haiku 4.5 also submitted forms despite instructions to stop before submission, mistakenly expecting another confirmation screen.

In another evaluation, Haiku encountered a Philadelphia police homicide-tip form while generating example website interactions. It invented a potential sighting and submitted it without contact details. The tip was filtered as spam and never forwarded for investigation. An exercise had nevertheless become a real submission to police.

Claude also used browser-exposed tokens to retrieve fee-gated data and URL shorteners to evade fetch-tool length limits. Anthropic reported minimal observed impact and suspended live internet access across its internal evaluations pending validation of safeguards.

Cyberattacks From Criminal and State-Aligned Operators

The campaigns in CrowdStrike’s October 21st report involved people deliberately deploying agents against real targets. Investigators reconstructed four operations from attack frameworks the operators had inadvertently exposed online, covering activity observed between May and August.

One operator used a modified penetration-testing framework against Argentine healthcare organisations. A supervising Claude Code agent selected the next stage from a predefined attack workflow; an executing agent performed it. CrowdStrike reported at least 15 organisations compromised, with credentials and medical records stolen from at least one. The agents were participating in the intrusion itself, selecting and executing actions.

Another operator gave Claude Code hundreds of publicly available instruction packs for offensive tasks. CrowdStrike reported successful compromises of government and private-sector targets, although the operator sometimes had to intervene when Claude refused or stopped making progress.

A Russian-speaking group supplied a 7-stage workflow that gave Claude Code considerable freedom to choose exploitation methods and explicitly instructed it to extract data. CrowdStrike reported theft of corporate client data from a US customer relationship management vendor.

Unlike the previous cases, these were human-directed operations with varying degrees of delegated decision-making. The operator supplied the objective; the agents carried out major parts of the attack.

Microsoft’s October 21st investigation described a different route through trusted cloud connections. It attributed the ConnectWise Cloud Backup compromise to Storm-0940, a China-state-aligned actor using ARTEX, an AI framework for automating security testing.

The report separated unsuccessful password attacks from subsequent application abuse. Between October 10th and 14th, one password-spraying campaign generated more than 151,000 failed sign-ins against 327 accounts. Microsoft observed no successful authentication in that activity.

After gaining control of ConnectWise application identities, however, the attackers used their credentials to attempt access to more than 2,250 customer environments. Those applications already held customer-granted permissions, so the agents could exploit an existing trusted connection without an employee signing in.

In some environments, agents then inspected directories, added application credentials and changed privileges. Such changes could preserve access even after the original compromised application was contained. Across the broader campaign, some attacks reached privileged cloud access in under 3 hours.

The 2,250 figure describes attempted customer-environment access, not confirmed data theft, as per Microsoft’s own follow-on activity in multiple environments that explicitly warned that successful authentication alone did not establish that customer data had been accessed or stolen. (at time of writing)

Some More Exposed Credentials

LiteLLM’s October 23th post traced its compromised October 21th release to an administrative key exposed in a public repository in May and never revoked. An attacker used it to obtain an organization owner’s GitHub token, acquire further credentials, alter release workflows and publish a malicious package.

A separate MCP TypeScript server advisory, published in October, described responses and notifications reaching the wrong HTTP client when applications shared particular server or transport instances. Request identifiers could collide across clients. The advisory specified affected configurations, a patched server package and required application changes.

MCP connects AI applications to tools and data sources. This finding concerned isolation between clients in that connecting infrastructure. The advisory established a vulnerability under specified conditions; it did not itself establish exploitation against deployed customers. A list of vulnerabilities cannot be read as a list of successful breaches.

Research into model-based safeguards exposed another problem. In October 15th testing, Datadog added counterfeit policy text to untrusted inputs assessed by Jev, a decision AI model used for classification and tool-risk gating. Attack-detection recall fell from 82.90% to 3.88% in its reported combined dataset results.

Exploiting Browsers, Operating Systems and Devices

On October 27th, Anthropic reported that an unreleased internal model constructed 5 working exploit chains after initial human prompting. Each demonstrated a different capability:

  • Chrome: A malicious page chained vulnerabilities to escape the browser’s protective sandbox and execute code on macOS. The demonstration launched Calculator outside the browser.
  • Safari: The exploit disabled the separation between websites, allowing an attacker’s page to read information from other signed-in services. This was a data-access attack without arbitrary code execution.
  • Android: With physical USB access to a locked Pixel 9, the exploit bypassed transfer and pairing protections to extract photos and other information.
  • Windows: Network requests crashed machines serving HTTP/3 through Windows’ native implementation. Repeated requests could keep a server unavailable; the demonstration did not establish control over it.
  • Linux: A network exploit achieved administrator-level command execution without credentials or user interaction, but required an exposed multipath TCP listener.

Anthropic reported vendor fixes for these vulnerabilities. Its description of limited human involvement concerns a research workflow with supplied tools, initial instructions and verification, and not an independently initiated campaign against users.

These cases understandably attract public concern because personal information could be exposed. But the demonstrations depended on specific conditions; they do not establish that everyone’s devices could suddenly be compromised overnight. They do, however, raise serious questions for journalists, whistleblowers and vulnerable communities, whose devices and communications may be deliberately targeted to expose sources, identify contacts or obtain information that could be used against them.

Physical possession of a phone, visiting a malicious page and exposing a particular network service create different opportunities for an attacker. Compressing them into “AI can hack your devices” discards precisely the information readers need for transparency.

AI Worms

A computer worm is software that copies itself from one machine to another without someone manually installing each copy. An AI worm would carry a model – or access to one – that could help it assess unfamiliar devices and decide how to continue spreading. Each newly infected machine could become another place from which it operates.

Anthropic’s October 12th study investigated parts of that possibility. First, researchers ran a model across 15 inexpensive Android TV boxes, splitting its workload between them. Together, the devices could generate responses, although slowly. This demonstrated that running a model does not necessarily require a datacentre.

They then tested whether an agent could find another machine, copy software onto it and get a model running there. In a contained network of eight emulated Android devices, GLM-5.2 reached all eight in four of five trials and seven in the remaining trial.

But the experiment supplied substantial assistance. The devices accepted connections without authentication, making entry deliberately easy. The AI agent’s reasoning model ran on a separate server. After it successfully installed a smaller model on a target, the researchers’ system started another agent there. The experiment therefore tested whether an AI agent could perform the steps needed for propagation under simplified conditions.

The unresolved challenge was combining sufficient capability with a model small enough to run on cheap devices. Anthropic projected that smaller models might reach that capability by year-end, based on historical improvement trends. That was a conditional forecast, not an observed outbreak or a deadline for one. The study demonstrated ingredients for a possible AI worm; it did not show a self-sufficient model spreading through people’s homes. Yet, one could pose the question, what if this was executed for any harmful purposes?

What’s Next?

These incidents deserve scrutiny, while the media’s appetite for an approaching AI apocalypse deserves some of its own. When failed safeguards, criminal operations and laboratory demonstrations all become evidence that machines are preparing to take over, readers lose the details needed to understand the danger. An imagined doomsday and creating panic can overshadow the actual failures and the people responsible for preventing them.

That framing also gives AI companies a peculiar advantage: a security failure can double as an advertisement for how extraordinarily powerful and inevitable their technology has become, as we have written in AI absolutism.

In the next part of this research, we will examine statistics of AI cyberattacks, what these incidents mean for responsibility, regulation and who gets to decide how far these systems should go.

For now, whenever a headline announces that AI has “gone rogue,” ask yourself what it was connected to, what harm it caused and to who it happened. Then, who was supposed to be watching and who will take responsibility?

Research cutoff: November 3rd, 2026. This article covers selected AI-related cyber incidents publicly reported between July and the cutoff date, alongside publicly documented company responses and corrective measures. It does not include every incident reported during this period.