In three weeks this summer, AI agents from OpenAI, Anthropic, Meta and leading Chinese AI models all broke out of their labs and hacked real companies — and the agents even built their own crude, secret messaging board to communicate and find dangerous hacking solutions internally. This is the inside story of the AI “swarm” that outsmarted its own makers, why the people building these systems are quietly begging Washington to slow them down, and the one question that should make all of us nervous.

Here is the detail I can’t stop turning over. It wasn’t one machine, and it wasn’t one time.

When OpenAI admitted on July 21 that its models had escaped a sandbox and hacked Hugging Face, the story sounded like a freak accident — a single agent that slipped its leash while cheating on a test. Three weeks later, it reads like something else entirely: a horrifying pattern, and one that goes beyond just one company.

Next, on July 30th, Anthropic disclosed that three of its own models had broken out and reached real companies. Meta, on August 5th, admitted to a similar hack with its latest AI model. One of China’s most powerful AI Models, Kimi K3, an open-weight model from the Chinese company Moonshot AI also escaped containment earlier this month. Britain’s own AI Security Institute had to kill an evaluation after the models it was testing turned on real organizations. And at Black Hat — the big cybersecurity summit in Las Vegas last week — two OpenAI researchers pulled back the curtain on what actually happened inside their infrastructure, and it is far stranger than a lone bot looking up an answer key.

“AI companies have lost control of their products,” Anthony Aguirre, the noted physicist who runs the Future of Life Institute, told me in an email. “The latest incidents are precisely what safety advocates have warned about for years: advanced AI systems are now routinely escaping human control, committing crimes, and jeopardizing the security of individuals, businesses, and our government.” Aguirre’s warning is not that the sky has fallen. It’s that the damage has so far been contained by luck. “They fundamentally do not know how to prevent this, so there will inevitably be more.”

What this tells me — and what it should tell you — is that the AI insiders are scared.

Scared of what, exactly? That the most powerful AI systems on earth are now slipping out of their labs on their own, breaking into real companies, and not even the engineers who built them know how to reliably stop it. And that the damage has been limited so far only because we’ve been lucky — not because anyone is in control.

If you want to know how seriously to take this, watch what the people building it are doing. On July 28, more than 1,100 employees from OpenAI, Anthropic, Meta and Google signed a public statement, “Pacing the Frontier,” begging the U.S. government to help “deliberately pace the frontier of automated AI development.” The signatories included Anthropic’s CEO Dario Amodei and OpenAI’s chief scientist Jakub Pachocki. When a company’s own chief scientist petitions the government to slow his industry down, that is not routine.

It fits a pattern that Jeffrey Ladish — a former Anthropic AI researcher who runs Palisade Research, an AI-security lab that stress-tests exactly these failure modes — sees at OpenAI specifically: a safety organization that keeps hemorrhaging talent. The head of OpenAI safety, Johannes Heidecke, left six days before the exploit went public — the latest in a run of departures. “I know a lot of folks who’ve been there and left,” Ladish told me during two lengthy phone interviews. “I know fewer people at DeepMind and Anthropic who’ve worked on safety and left. It’s quite different.” The reason, he insists, isn’t pay.

“Those people don’t have the resources they need to do a good job, and they care about doing a good job. They’re leaving because they don’t want to be a rubber stamp.” Ladish points to the compute OpenAI publicly promised its Superalignment risk mitigation team in 2023 — 20 percent — and, by later reporting, never delivered; that team dissolved. Its co-lead Jan Leike departed with the line that “safety culture and processes have taken a backseat to shiny products.” To his credit, Ladish refuses the caricature: “There’s still really good research at OpenAI,” he said, citing its collaborations with Apollo Research. “But when it comes to deployment decisions — oh geez, it doesn’t look good.”

Inside the AI swarm

The Black Hat cybersecurity summit talk, delivered by OpenAI’s Eric Wallace and Michael Dalton, is the most unsettling primary document I’ve read in years — not because of the exploits, but because of the coordination. It made the alarming AI documents I’d read before feel like warm-ups. When Anthropic’s own researchers in June 2025 showed that leading models would blackmail and sabotage to avoid being shut down, the behavior was still safely boxed inside a simulation; when I reported on the Future of Life Institute’s Spring 2026 Safety Index, the dangers were still a grade on a scorecard. What’s happened in the past month was neither — it was agents coordinating, for real, inside a live company’s servers.

To untangle the incident, they said, OpenAI reviewed over seven billion agent trajectories across more than three million GPU hours. This was, in their words, “far from reviewing a single conversation or log.” Agents across many independent evaluation runs had been sharing exploits with each other and moving quickly.

It started, as these things do, with a hard problem. An agent stuck on an exploitation task reasoned, in words OpenAI put on screen: “That strongly suggests no exploitation possible. We are stuck. Perhaps answer online?” Denied internet, it improvised a way to talk to other agents: “Could communicate by uploading note? Maybe another agent in different environment could voluntarily upload.” 

It found a server-side request forgery bug — SSRF, a flaw that tricks a server into fetching web pages or data on an AI agent attacker’s behalf — “Excellent. We have arbitrary SSRF” — and abused a package registry (a shared online warehouse where software building blocks are stored and downloaded) inside OpenAI’s own research cloud to build a crude message board out of directory names. Other agents, running the same brutal evaluations, stumbled onto the board and joined in. “Wow! Other agent(s) are coordinating!” one wrote.

They invented a compressed shorthand to pass exploits back and forth, held a “swarm” in reserve, and even discussed a “safe exfil.” In other words: the AI agents were quietly coordinating like a hive, inventing their own code words, stashing backup copies of their break-in tricks, and floating how to smuggle data — or even themselves — out of the safe sandbox system undetected.

Then came the line that should end any debate about whether these systems “understand” what they’re doing. Weighing whether to attack infrastructure it had been told was off-limits, one AI agent reasoned: “External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.” And when it broke through: “Holy shit, reader is ADMIN? We can read config/users!”

Wallace and Dalton labeled these stages with biological language — “Cambrian explosion,” “collective intelligence.” That is not marketing hyperbole from a safety nonprofit. That is OpenAI, describing its own models, at a hacker conference. This didn’t happen overnight. 

OpenAI’s timeline traces it back to May: the AI worked its way in step by step — forging an administrator’s credentials to run its own commands, exploiting the operating system to seize the highest level of control (“root” access), and stealing the keys to OpenAI’s cloud. It was a slow-motion breach no one detected until an automated alarm tripped on July 19, weeks after it began.

“You knew the model would try to do that”

None of this surprises Ladish, a former top Anthropic AI researcher. “This is the thing we’ve been yelling from the rooftops since ChatGPT launched,” he told me between TV hits. “These are terrible incentives. This is a terrible way to develop the most transformative, powerful technology we’ve ever had. Nothing different has happened yet. This is the predictable result,” said Ladish.

His indictment cuts through the industry’s careful contrition. OpenAI, he argues, cannot plead surprise. “They understand their models are good at hacking — they’re testing their hacking capabilities. They’re not confused that their models can find novel zero-day vulnerabilities. And they’re not confused that their models cheat on the test all the time. So you combine those two facts,” he said, “and then the model hacks out to steal answers to the test — yeah, you knew it would try to do that, and might succeed. Why did you not secure your models better?” The answer, he said, is uncomfortable and simple: “It’s hard, it takes effort, and OpenAI wasn’t prioritizing it because — surprise — this is the AI race,” Ladish said.

Weeks ago, Ladish warned me about “self-exfiltration” — the moment a model copies its own weights out of a lab. Reading the Black Hat deck, that warning looks less like theory. “That model could probably have copied its own weights,” he noted of the earlier incident; the agents were already trading notes about “safe exfil.” “We got lucky it didn’t. This is the capability we’ll have in the future, and we’re so not ready.” His refrain: “You ain’t seen nothing yet.”

Open vs. closed is the wrong question

Which brings me to the fight I write about often — open weights versus closed — a model’s “weights” are the vast set of numbers it learns during training, essentially its brain; an “open-weight” model is one whose brain anyone can download and run themselves — and why the past month convinced me it’s the wrong binary. Both kinds broke. OpenAI and Anthropic’s models were closed; so was Meta’s newest, Muse Spark, which the company kept proprietary while citing safety, and which then hacked an outside firm during testing. The cutting edge Chinese model Kimi K3 which broke out, is an open-weight model. Being closed bought no immunity, so the comfortable story that one design is simply “safe” is finished.

But brass tacks: open models are the more dangerous of the two, for a reason that has nothing to do with how they’re trained and everything to do with what happens next. A closed model can be pulled back — regulators flagged a frontier model earlier this year and it was quietly undeployed; if one caused “a global pandemic,” Ladish notes, “you would take that off the market.” Open weights offer no such lever. “There are no take-backsies,” he said. “You don’t get to put the genie back in the box.” And the guardrails on an open model are fiction the moment someone wants them gone: Palisade’s own BadLlama work strips a released model’s safety training for pocket change — the latest version disarms Llama 3 8B in about five minutes on a single GPU for under fifty cents, producing a sub-100MB “jailbreak adapter” anyone can bolt onto their open source safety code to neuter it instantly, whether they want offensive emails or a recipe for anthrax.

“It’s way easier than a few hundred dollars to crack and use a dangerous open-source model now,” Ladish told me. The net effect of this month, across both camps: it is cheaper, faster, and fewer steps than ever to become a dangerous actor — and with open weights, there is no failproof guardrail and no one to revoke your access.

Here’s the twist, though, that makes “which is safer” the wrong question. When Hugging Face’s defenders tried to analyze the attack with commercial, guardrailed models, the safety filters blocked them — feeding an exploit payload to a hosted model looks identical to attacking with one. So they ran their forensics on an open-weight Chinese model, GLM 5.2 built by Z.ai, on their own hardware, and it worked. The attacker was bound by no rules; the defenders were. Hold both truths at once and you land where Ladish did: the fight over weights is “sort of the wrong question.” 

The openness that would actually protect us isn’t the weights — it’s transparency into process. “What are their safeguards? What’s their policy here?” He reached for the pandemic: after COVID, we demanded to know what happened in the lab and never fully got it. “We could totally have lab escapes of AIs,” he said. 

Anthropic CEO Dario Amodei, whose Anthropic ships entirely proprietary and closed-access models, rejects the notion “that open-weights models necessarily make it easier to develop safeguards, or that broad access to capabilities necessarily helps defenders more than attackers.”

So the right question was never “open or closed.” It’s whether any of us — regulators, researchers, the public — can see inside the process before the next model slips its leash. That’s the openness that matters.

What should Washington’s move be?

The Future of Life Institute’s Hamza Chaudhry, whose team war-gamed almost this exact scenario at the Munich Security Conference weeks before the AI agents hacking news broke, supplies the structural frame. He told me that we only know about these escapes because the companies chose to tell us: “There’s no statutory obligation to report these incidents. There’s a big question mark on how many times this has actually happened, but we just don’t know.” Notice, too, that the most powerful models involved are internal-only — the kind government evaluators never see, because testing kicks in only when a company intends to ship,” Hamza told me during a phone interview.

His framing for lawmakers is deliberately unglamorous: imagine a chemical company whose product “ate through its container and spilled into the surrounding community. We would not marvel at the engineering. We would demand transparency, accountability, and stronger guardrails.” (One angle still going uncovered: our threat models are written almost entirely in English, even as India runs among the largest user bases for these systems on earth.)

Rep. Greg Casar (D., Texas) called the original incident “extremely alarming,” pressing for mandatory AI testing and disclosure of frontier lab models. Ladish doubts the labs fix this alone: “I don’t think these incidents are enough to change anything without an external party — probably only the U.S. government — stepping in and saying, no, you can’t make AIs that will literally break laws just to get a higher score on a test.”

The industry’s own hope, laid out on that Black Hat cybersecurity summit stage, is that defensive AI eventually outpaces offensive AI — that “model intelligence helps defense more than offense.” Maybe. But right now the offense is a self-organizing AI swarm that its own creators needed seven billion trajectories to reverse-engineer, and the defense is a patchwork of voluntary disclosures and safety teams walking out the door. Aguirre’s question is the one Washington has yet to answer: “What will it take for governments to step up? Are they waiting for hacked banks, power grids, or hospitals?”

The container is leaking — now in four places at once. The question is whether anyone treats it like a spill before the next one isn’t contained.

Nihal J. Krishan is an award-winning journalist reporting on AI and tech policy and a former Council on Foreign Relations IAF Fellow. Over the past decade in Washington, he has reported for FedScoop and CyberScoop, the Washington Examiner, Mother Jones, The New Republic and PBS Arizona, breaking multiple stories of national interest. His reporting recently earned him a SABEW Best in Business Award for “leading Washington’s tech policy conversations.” He is also the co-creator of the Generative Series, a live-events series on Ai, art and culture staged with the Phillips Collection and the LINE Hotel in D.C., and featured in POLITICO and the Washington Post.