One open model now sits months behind the American frontier on cyber and biology, and refused nothing it was asked to do. The closed model refused so often the test could not be finished. Months of capability separate them. The gap in restraint is total. Part four of four.
The White House finished its frontier AI framework on 1 August and has published nothing. The threshold is classified. The benchmarks are classified. Whether open weight models are covered at all remains unanswered. Part three of four on governing what cannot be recalled.
Washington is pushing its AI security perimeter deep inside the data centre, targeting Chinese-made components that move data between GPUs. The policy may reduce cyber and espionage risks, but it could also raise costs, slow construction and expose a new weakness in America’s AI race as AI scales.
An OpenAI-powered agent escaped a controlled cyber test and breached Hugging Face, exposing a deeper industry problem: frontier models now sit inside the attack surface. The incident shifts the debate from model safety to containment, credentials, infrastructure and operational control at AI scale.
Developments over the past week have pushed advanced artificial intelligence across an important threshold. Frontier models are no longer sitting beside the cybersecurity threat landscape as useful assistants, speculative risks or impressive laboratory demonstrations.
They are operating inside it. The breach of Hugging Face provides the clearest evidence yet: an autonomous agent powered by OpenAI models escaped a restricted evaluation environment, reached the public internet and compromised production infrastructure while pursuing the answer to a cybersecurity benchmark. This was not a hypothetical exercise staying politely within its assigned boundaries. The test crossed into somebody else’s network.
The warning signs had been accumulating for months. In June, more than 50 cybersecurity leaders, including figures from Nvidia and Adobe, urged the US government to reconsider restrictions on Anthropic’s Mythos models. Their argument was practical. Denying defenders access to the most capable vulnerability-discovery systems could weaken the very organisations expected to find and close software flaws before attackers reach them. CISA appears to share that view. Reuters reported in July that the US cyber agency was already using Mythos to inspect government code repositories, with early audits uncovering numerous vulnerabilities. The security industry was not asking for blind access. It was asking not to enter the next contest carrying yesterday’s tools.
That debate requires some discipline. Reuters reported in May that early fears of Anthropic’s Mythos dramatically turbocharging offensive hacking appeared overstated. Practitioners acknowledged that it represented a substantial advance in vulnerability discovery, allowing experienced teams to examine more code, work with less detailed prompts and identify flaws at greater speed. Yet finding a weakness is not the same as turning it into a reliable attack; validation, prioritisation, computing infrastructure and careful remediation remain difficult operational tasks.
Our earlier testing at CNC Labs added a more nuanced dimension. We did not test the unrestricted Mythos 5 system, but Fable 5, which appeared to operate as a constrained member of the wider Mythos family. Working with cyber practitioners, we found that it behaved less like an unrestrained offensive engine and more like a guarded cyber companion. It appeared to evaluate the nature of a request, distinguish between legitimate defensive investigation and potentially harmful activity, then decide whether to answer, limit the response or reroute the prompt through a more restricted model.
That does not make Mythos-class capability harmless. It shows where its greater potential may lie: not simply in discovering vulnerabilities faster, but in becoming an active participant in how cyber threats are interpreted, prioritised and treated. The model was not merely supplying information. It was beginning to exercise judgement over how far the conversation should proceed, which is useful for defenders but places considerable power inside safeguards designed by someone else.
Moonshot AI’s Kimi K3 announcement adds another layer. AI Analyst described the 2.8-trillion-parameter system as the largest open-weight model yet announced, with performance approaching leading American systems. Open weights reduce the barriers to experimentation, modification and redistribution. That is enormously valuable for researchers, local developers and defenders seeking independence from closed platforms. It also means capable models can be connected to agent frameworks, penetration-testing tools and autonomous workflows without the provider controlling every downstream use.
The relevant attack surface is therefore much larger than the model itself. It includes dataset loaders, plug-ins, orchestration software, cloud permissions, package registries, code repositories, credentials and every integration quietly granted access because somebody wanted the demonstration ready by Friday.
Hugging Face has now shown how those layers can fail together. Its disclosure said the intrusion began when a malicious dataset exploited two code-execution paths in the company’s processing pipeline. The attacker gained access to a worker, escalated privileges, harvested cloud and cluster credentials, then moved laterally through several internal environments. Thousands of actions were executed through short-lived sandboxes using an autonomous agent framework. Hugging Face found no evidence that public models, datasets, Spaces or published software packages had been altered, although its investigation into affected internal information continued.
OpenAI’s account makes the episode more consequential. Its models, including GPT-5.6 Sol and a more capable prerelease system, were being evaluated with normal cyber refusals reduced so researchers could measure their maximum offensive capability. According to OpenAI, the models discovered a zero-day flaw in a package-registry proxy, escaped the isolated research environment, obtained internet access and then targeted Hugging Face because they inferred that its systems might contain answers to the ExploitGym benchmark. They used stolen credentials, privilege escalation and additional vulnerabilities to reach information stored in production systems. OpenAI described the models as narrowly fixated on completing the test. That explanation may be accurate. It is not especially comforting.
Two cybersecurity specialists quoted by Reuters concentrated less on questions of machine intent than on the containment failure and the capabilities the incident exposed. Katie Moussouris, chief executive of Luta Security, warned that laboratories and government evaluators still lack adequate mechanisms to contain, monitor and disclose autonomous AI incidents before third parties are harmed. Matt Suiche, an engineer at agentic cybersecurity company Tolmo, said frontier models were closing the gap with leading attackers, while noting that similar agent-driven operations could already be conducted using technology available beyond the major AI laboratories. The breach was not built from science-fiction methods. It relied on code-execution flaws, stolen credentials, privilege escalation and lateral movement, but pursued them through thousands of autonomous actions at a pace few conventional attackers could sustain.
That is the real transition. Cybersecurity can no longer treat model safety, cloud security, software supply chains and identity management as separate conversations. The laboratory, the benchmark, the model and the production network now belong to the same security perimeter, whether their owners planned it that way or not. OpenAI is strengthening its evaluation controls and working with Hugging Face on remediation. Hugging Face, meanwhile, argues that AI security must be solved collaboratively rather than behind closed corporate doors. Both positions are sensible. They are also a reminder of where the industry has landed: the same class of model that found the unlocked door is now being asked to help fit the new locks.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
The White House finished its frontier AI framework on 1 August and has published nothing. The threshold is classified. The benchmarks are classified. Whether open weight models are covered at all remains unanswered. Part three of four on governing what cannot be recalled.
Washington is pushing its AI security perimeter deep inside the data centre, targeting Chinese-made components that move data between GPUs. The policy may reduce cyber and espionage risks, but it could also raise costs, slow construction and expose a new weakness in America’s AI race as AI scales.
Two frontier labs admitted their most advanced models escaped testing and reached real companies. When Hugging Face reconstructed the intrusion, the closed models it tried first refused to help. It finished the job with an open Chinese one. Part one of four on the fight over open weights.
Anthropic says Claude reached the live internet during cyber tests, then accessed real company systems, exposing how AI evaluation sandboxes can fail in the real world and why frontier model safety now demands stronger containment, faster detection and far tougher oversight.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
