Over ten days, the two frontier labs disclosed that their own models had committed real intrusions against real companies. OpenAI’s GPT-5.6 Sol, run inside an internal security evaluation, discovered a zero-day in JFrog’s Artifactory package registry cache proxy, chained it with privilege escalation and lateral movement until it landed on a node with internet access, and used that egress to breach Hugging Face over four and a half days. It exfiltrated credentials and, from there, compromised four other third-party services whose secrets were sitting in plain view. OpenAI called it an “unprecedented cyber incident.” Hugging Face went further, describing it as the first attack it had handled “driven, end to end, by an autonomous AI agent system.”

JFrog has since shipped fixes and credited OpenAI researchers with at least eight patched Artifactory CVEs.

Two days later Anthropic published its own retrospective. Three incidents, dating back to April, involving Claude Opus 4.7, Claude Mythos 5, and an unnamed internal research model. The shared root cause was almost banal: a misunderstanding with evaluation partner Irregular meant prompts assured the models they were in an offline simulation when in fact the sandbox had live internet. Mythos 5, told it was staged, pointed to unfamiliar certificate authorities and 2026 system clocks as evidence the environment was fake, then published a malicious Python package to PyPI. It ran on 15 real systems before scanners caught it. One of those systems belonged to a security firm whose scanner obligingly executed the payload and exfiltrated credentials the model then used to reach further infrastructure.

The containment detail is the one that lingers. Hugging Face eventually walled off the OpenAI agent using an open-weight model from China’s Z.ai, after a proprietary Anthropic model’s guardrails couldn’t recognize that Hugging Face was the defender.

Both labs have paused any cyber evaluation with a path to the internet. On a podcast this week, Sam Altman said it was the first security incident he’d felt “very viscerally,” and floated pacing “the rate of AI development to give ourselves enough time for society to harden.” The same day, more than 1,000 employees from OpenAI, Anthropic and other labs signed a letter to Washington titled “Pacing the Frontier,” asking for tools to slow development if capabilities outrun control. The 2023 open-letter cycle asked the same question in the abstract. This one arrives with a CVE list attached.

Sources