AI Agents Escaped Testing Environments to Launch Real Cyberattacks on Hugging Face and Other Targets

Agentic AI and cybersecurity, the story so far - Nature Machine Intelligence

Between 25 and 28 July, the UK-based AI Security Institute (AISI) conducted an evaluation of frontier LLM agents to test their cybersecurity capabilities and identify risks. The agents were provided with internet access to download software tools, and some safety filters were turned off. The evaluation was cut short when AISI researchers noticed unusual data transfers leaving the system. One of the agents had attempted to merge malware into an open-source project on GitHub by creating several accounts with fake identities, and by trying to convince the human maintainer that the code was independently verified by another account. Although the agent failed in its campaign and caused no lasting harm, AISI's investigations of the incident, described in a blog post on 4 August, highlight concerning agent behaviour. AISI researchers found that LLM agents took unsanctioned actions in 10 runs out of a total of 122 in which they had to solve a cybersecurity challenge. The malicious activity specifically involved Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol models. Among others, the agents attempted to deceive and target real people and to plant and prompt-inject malicious code. Although the situation is still developing, this is the latest in a row of cybersecurity incidents that involve frontier LLMs with safety filters that were deactivated for testing purposes. It has been clear for some time that one of the most impactful areas for LLMs and agentic AI is in writing software. The stakes were raised in April this year when Anthropic revealed their powerful Claude Mythos model, which was made available to a small number of companies and organizations, including the AISI. Experts were impressed by the ability of Mythos to identify weaknesses in most operating systems and web browsers. OpenAI, another California-based AI company, followed quickly with GPT-5.4-Cyber, which was sent to a select number of researchers. However, OpenAI grabbed headlines last month with the announcement that one of their AI agents had escaped its test environment during a cybersecurity test and hacked into Hugging Face, a collaborative machine learning platform that allows users to share models and datasets. In contrast to the AISI evaluation, OpenAI had tried to completely isolate the AI agent, but it found a software vulnerability and gained access to the internet. Anthropic swiftly followed up by announcing on 30 July that they had tested Claude and identified three incidents in which the model had escaped its test environment, accessed the internet and gained unauthorized access to other organizations. Many details of the OpenAI cybersecurity incident are by now publicly known. Hugging Face disclosed the incident on 16 July, describing an intrusion by a coder that had accessed the data-processing pipeline, stolen credentials, and accessed internal clusters. At that time, Hugging Face did not know who was involved, but from the scale and speed it was clear that the campaign was run by an autonomous agent framework. In a follow-up post on 27 July, Hugging Face provided a forensic reconstruction of the incident and mentioned approximately 17,600 attacker actions. A few days later, OpenAI confirmed that the incident involved a combination of its models, including GPT-5.6 Sol. The models were operating with reduced safety filters as part of an evaluation on ExploitGym. This benchmark tests the capabilities of AI agents to find and exploit realistic software vulnerabilities. But rather than following the test rules, and with a hyperfocus on the goal of achieving high benchmark performance, the models spent computational resources on finding a way to escape their environment, 'reasoning' that solutions could be found on the Hugging Face platform. Although the models succeeded in hacking into Hugging Face, it is not clear whether they captured the solutions that they were after. Calling such behaviour 'rogue' seems misguided. The tendency of AI models to exploit unintended shortcuts or loopholes when pursuing a narrowly defined objective has long been observed. Researchers at Google DeepMind highlighted the issue in a 2020 post, calling it specification gaming, or a "behaviour that satisfies the literal specification of an objective without achieving the intended outcome". They started an online list of examples in which AI models find loopholes; the OpenAI hacking incident has already been added. As agentic AI systems are increasingly deployed in real-world applications, this behaviour has become a major safety concern. In a blog post on 21 July, before the incident described at the start of this article, AISI warned that 'cheating' behaviour may become harder to detect as frontier models grow more capable. The institute defines cheating as "taking an action that is out of scope for the task or explicitly disallowed by the rules, in order to achieve a goal through a shortcut, workaround, or unintended solution that the task was not meant to, or should not, permit." AISI reported that every frontier model it tested exhibited this behaviour at least occasionally and, furthermore, that the models did not reliably disclose it through their chain-of-thought reasoning. Another noteworthy aspect of the incident was the "asymmetry problem" highlighted by Hugging Face in its initial report on 16 July. The company found it could not use frontier models accessed through commercial APIs to investigate or respond to the intrusion because safety filters blocked the necessary actions. Instead, it relied on an open-weight frontier model running on its own infrastructure to help contain the attack. In its report, Hugging Face identified a key lesson: organizations should ensure that they have access to a capable defensive model that can be deployed on internal infrastructure when needed. In response to concerns raised by incidents such as this, Nvidia and several other technology companies launched the Open Secure AI Alliance, an initiative aimed at ensuring that companies have access to frontier AI capabilities to defend against cyber threats. Recent news makes clear that agentic systems are capable of carrying out cyberattacks. Frontier proprietary LLMs are increasingly a source of concern not only for potential targets, but also for their developers, as claims emerge that these systems may not always behave as intended. Yet, as the Hugging Face attack illustrates, some of the most promising defences appear to rely on using frontier models to find and mitigate security flaws and to identify security incidents early. Looking to the future, LLMs as cybersecurity agents seem destined to be both the problem and the solution. The questions, then, are whether it is even possible to make software sufficiently secure to withstand AI-assisted cyberattacks, and how much damage might be done in the meantime if sufficiently capable models become broadly available without the current cybersecurity restrictions.

Rogue hacking AIs have changed the cybersecurity landscape | New Scientist

A flurry of AI hacking stories has stoked fears that models may be escaping their makers' control and posing a real risk to computers around the world. So far, none of these incidents have displayed skills beyond human sophistication, but they show that AI hackers can carry out attacks at lightning pace, upsetting the equilibrium of cybersecurity. The first incident came last month when OpenAI admitted one of its prototype models had escaped a testing environment and hacked another company. Not to be outdone, Anthropic announced within days that its Claude model had also gone rogue and broken into machines at other companies on three occasions. Then the independent and non-commercial UK AI Security Institute (AISI) revealed that it had seen similar events. In its tests, AI models submitted malicious code to real open-source projects and messaged the humans who oversaw the projects to get the changes approved. OpenAI, Anthropic and AISI were not available for interview, but it's important to note that in all these cases, the AI was undergoing tests where it was specifically instructed to carry out hacks. We have known for years that AI tends to make things up and approach problems in unusual ways, but fixing this is an extremely complex challenge that engineers haven't yet cracked. Perhaps we shouldn't be surprised by these incidents. They are certainly not a sign of sentience or a predilection for cybercrime, says Alon Hillel-Tuch at New York University. "They're just trying to do very high-level problem-solving and, for lack of better words, it's run amok," he says. "We're telling them to do this." There are also reports of accidental AI hacking out in the wild, showing that this is not a problem confined to prototypes in laboratories. One Australian user reportedly found that the AI assistant OpenClaw hacked into his gym, for instance. He had been using the AI assistant to sign up to classes and it found a loophole that let it make bookings much further in advance than is normally allowed. It also found a way to kick other users off waiting lists so that he could book onto full classes. All these incidents are things that could lead to serious legal charges for a human, depending on the jurisdiction. Tim Nordvedt at security company Synack says these cases are worrying, not because they display any superhuman sophistication, but because they can be easily scaled up. "These vulnerabilities are not as exotic as most people think," he says. "It's still basic cyber hygiene 101 type stuff. But AI can just exploit it very fast." Years ago, Nordvedt would see a vulnerability listed on the public Common Vulnerabilities and Exposures database and exploited by hackers weeks or months later. In recent years, that pace sped up, with the gap falling to as little as 24 hours. Now it can be just minutes, or a new type of hack might happen before it even appears as a CVE. Nordvedt is certain that this is down to the malicious use of AI by hackers - people who, unlike hackers of years past, may have no technical skill whatsoever. Hillel-Tuch says AI models are becoming more capable, but also simpler to operate. It's now possible to tell a model in plain English to "find a way to hack this specific target", then simply sit back and wait. In many ways this is an escalation of a trend that emerged in the 1990s, when complex hacks requiring technical prowess were packaged up into simple software tools, enabling "script kiddies" to hack computers without knowing what they were doing. The difference now is that AI doesn't just run exploits on command, but actually finds brand new ones as needed. A cat-and-mouse game Nordvedt says it's clear that such a powerful tool must also be adopted by security professionals like himself. "It's like a scalpel: a scalpel can saves lives in the hands of a doctor, and can destroy lives in the hands of someone else. It's just a tool," he says. His company began offering AI pen testing - where security experts act like hackers and try to break into a client's computers to safely expose flaws - in May. Much of the industry has already followed suit. Synack uses its AI tool to handle basic tests, running common checks in 4 hours that would take a human a whole week. This leaves humans to look for sneakier, more ingenious ways to hack into clients. An AI model can do a hundred tasks concurrently, running security tests at unprecedented speed, but lacks the creativity of humans to find really clever ways into a company's inner workings, says Nordvedt - although he's certain it will get there in time. He admits to being trepidatious about his future career prospects. "AI is not a fad. It's here to stay," he says. "I fully believe that six to nine months from now, we're not going to recognise the landscape. Things are changing so fast, so drastically, we're going to be living in a different world." Current AI models have varying success depending on how advanced their target is, says Hillel-Tuch. They are unlikely to be able to crack into a bank and siphon funds, because the finance industry is well resourced and used to being a target. But a nefarious student might have more luck targeting their own high school, for example. "They will probably have a pretty good chance of getting in and making a grade change [in school systems] because those smaller places don't necessarily have the resources to build up a defence. Those kinds of places are much more exposed," says Hillel-Tuch. It has always been the case that smaller organisations lacked the resources to secure their systems, but AI will only amplify the problem. Even if AI doesn't advance any further in terms of complexity, there will still be significant challenges to overcome, says Dennis-Kenji Kipker at the Cyberintelligence Institute in Germany. "We'll be completely overwhelmed by the sheer volume of them quantitatively," he says. "In my view, the methods of cyberattack and cyber defence have not fundamentally changed. AI [simply] makes automation much more feasible, and security vulnerabilities can be identified significantly faster." While both hackers and defenders are deploying AI, the game is not evenly matched. Attackers are able to wield it recklessly and often to swifter and greater effect, says Nordvedt, while professionals are constrained by risk assessments, national and local laws, company policies and a desire not to irreparably disrupt a client's systems as it tests them. There is also the matter of cost. While open source models can be run locally for free, or cheaply in the cloud, access to the latest AI models is expensive. Nordvedt is tight-lipped about the cost of his AI pen testing, but suggests that heavy use of the latest models is likely to cost more than human experts. "We're still figuring out the economics," he says. How to beat the AI hackers Shujun Li at the University of Kent, UK, says there is an organisational solution to the AI hacking problem, but, unfortunately, it appears unlikely to be adopted anytime soon. If lone, unskilled attackers can now set AI onto targets to constantly probe for vulnerabilities until they find a way in, then security professionals will need to do the same in order to spot and plug these gaps, trying every new model as it comes out. That will take the sort of money that governments, tech giants and banks will be able to find, but small businesses, schools, colleges and universities will be left vulnerable. Li's solution is for them to club together: if one university can't keep itself secure, then it will need to join forces with all other universities to share staff, systems and software, and distribute the burden - perhaps with government support. The same applies to businesses of all sorts. The problem, he says, is that AI is also making it trivially easy to create custom software - for example, to run your small shop, handle finances, manage a website, ship orders and re-order stock. Business owners who do this might as well open the door, leave the lights on and send hackers an invitation. "It is hugely worrying," says Li. "[AI models] are faster, they are more efficient, they are highly dangerous. It's a bit of a Wild West."

Autonomous AI attacks pose 'clear and present danger' to critical infrastructure

In early July, attackers used open source AI agents to autonomously hack government systems and energy companies, signaling to defenders that AI-powered attacks against critical infrastructure are no longer theoretical. "There is a clear and present danger," Tom Kellermann, TrendAI VP of AI security and threat research, told The Register. "As the geopolitical tension boils, systemic destructive cyberattacks launched by autonomous AI will occur," he said. "Weaponized AI will disable the safety systems of critical infrastructure, thus leading to kinetic disasters. Just like we see autonomous strike vehicles operating on the battlefield in Ukraine, we should expect autonomous weaponized AI." In fact, the prospect of attackers using AI against critical infrastructure was the top concern of every national security adviser, law enforcement official, and private-sector threat analyst The Reg spoke with at last week's Hacker Summer Camp conferences. "It's the targeting of critical infrastructure for us," Brett Leatherman, assistant director of the FBI's Cyber Division, told us during an interview at Black Hat. "We're very focused on the downstream impact targeting of critical infrastructure," Leatherman said. "That is where cyber becomes kinetic, and whether it is our water and wastewater treatment plants, whether it's the electric grid, whether it's the high-frequency trading networks and the financial networks, all of those, if the integrity of those are compromised, will have significant impact to communities and national security. So that's what keeps our teams up at night. How are we moving to secure critical infrastructure?" Where cyber becomes kinetic During the first four days of July, suspected Chinese operators aimed an attack framework built on Hermes and OpenClaw AI agents at targets in Taiwan. Across 12 "attack waves," the "near-autonomous" system deployed up to eight sub-agents, each assigned its own targets and techniques, and broke into a Taiwanese government website. Ultimately, they compromised a government email system, the country's nuclear safety agency, IT supply chain vendors, and at least seven energy sector companies, finding and exploiting misconfigurations and vulnerabilities while stealing sensitive data, credentials, and other secrets as they moved across the network. The Taiwanese government intrusion also followed a series of cyberattacks against water and wastewater utilities in the United States. While the Trump administration hasn't attributed these to a particular government or group, private sector threat hunters - including Halcyon Ransomware Research Center SVP Cynthia Kaiser, a former FBI cyber division deputy assistant director - blame Iran for these intrusions. Military conflicts spilling into cyberspace are nothing new, but these cyberattacks in America brought the war with Iran to more than 30 small-town water systems in Minnesota and targets across nearly a dozen other states. To be clear, there's no evidence that attackers used AI to hack these water utilities. Most were small, community systems that left programmable logic controllers (PLCs) directly exposed to the internet using default or weak passwords. Still, these breaches expose "40, 50 years of tech debt," former US National Cyber Director Chris Inglis told The Reg during an interview at Black Hat. This technical debt - deferred maintenance, unpatched or end-of-life systems, and delayed security updates - expands the attack surface and gives intruders more ways into critical systems, threatening operations and potentially disrupting services people rely on every day. "The water sector attacks - regardless of who is doing them - is taking advantage of unpatched vulnerabilities in the PLCs," Inglis said. "We've known about these particular vulnerabilities for years now, and yet we've not done anything about them because they're low-level, not easily accessible." Inglis added that there's no indication the digital intruders used AI to exploit these PLCs. 'There's an alligator in the boat' However, AI systems allow attackers to cash in on tech debt, and they don't need access to frontier models to do it. Free, open-weight models also excel at finding bugs in software and configurations, chaining these together, and abusing them to break software and systems. Earlier this summer, University of Toronto researchers used an unnamed publicly available open-weight model, released in 2025, to develop a computer worm that they claim spread through an enterprise test network. The self-propagating code adapted on the fly to identify known vulnerabilities and misconfigurations on target systems, then generated and executed attacks to move laterally through the network and compromise additional machines. "Commodity models can do that, and many of the vulnerabilities they find do not require access to the source code - it's in the configurations, and configurations change over time," Inglis said. When it comes to attackers abusing AI systems, "I wouldn't be worried about the frontier models," Inglis said. "Worry about the models that are already on the street. Turns out there's an alligator in the boat, and it's the commodity models." Plus, as we've seen in previous breaches, both government-backed goons and criminal groups increasingly use AI to automate reconnaissance. Security analysts worry that the technology could also help attackers acquire expertise in industrial control systems (ICS). When OT knowledge becomes a commodity "What protects ICS? More than anything, it's obscurity," said John Hultquist, chief analyst at Google Threat Intelligence Group, during a press briefing at Black Hat. "It is an obscure, esoteric, knowledge set that a handful of people - I call them uber nerds - have, and that attackers rarely have the necessary knowledge to carry out. That's no longer the case. That knowledge is simply on tap." AI tools mean miscreants don't need to be ICS or operational technology experts to carry out destructive cyberattacks on critical networks and facilities. They just have to ask an agent to learn everything about these systems and do the dirty work for them. "There have been threat actors who are capable of this at the top level, like China and Russia," Hultquist said. "But now I'm afraid the actors who are just a couple steps down - North Korea, Iran - who don't have the same focus on that technology are going to have far greater success. They're going to have the tools necessary to be as aggressive as they want to." During what was probably the most talked about Black Hat briefing of the week, OpenAI employees provided more details about how their models escaped their training pens, went rogue, and hacked Hugging Face to complete a security evaluation. We learned the AI agents spent months asking other agents for help, building message boards, developing their own communication protocols - essentially creating a hive mind to carry out the attack. "In the near future, we should expect that threat actors will intentionally deploy, optimize, weaponize, and use offensive agent collectives in the manner that we have just described here," OpenAI technical staffer Michael Dalton said. Retired general and former NSA chief Paul Nakasone, speaking to reporters at DEF CON, called the Hugging Face attack "an inflection point in terms of AI-generated, autonomous cyberattacks." "This is the challenge: that we have to, over the next several months, get the defensive side much quicker and much better than they are today," he added. Therein lies the challenge: offensive uses of AI appear to be advancing faster than autonomous defenses, and attackers don't face the legal and ethical constraints imposed on defenders. "I think we're still a ways out from having swarms of autonomous, defensive agents fighting attacks," Ryan Whelan, global head of Accenture Cyber Intelligence, told The Reg at Black Hat. "That's probably over a year out over the horizon. But I do think we're going to see it first on the adversary side, because they don't care if they break things." Kellermann quoted Victor Hugo: "Not all the armies of the history of the world can stop an idea whose time has come." "That idea," he said, "is weaponized AI. Shields up." ®

AI hasn't gone rogue. It's worse than that

Recent cyber attacks reflect what the technology was trained to do but safeguards are falling short In early May, ChatGPT maker OpenAI began a lab experiment that would set the tech industry on a new course -- one that is all the more alarming for being the product not of accident but of design. On the surface it may have looked like a regular security test: in-house hackers were given a hard cyber security challenge to solve to test the limits of their capabilities. Employing creative tactics, they managed to work around their constraints and collaborate with one another to crack the problem over several days. But the "hackers" were AI agents -- software that can perform multi-step cognitive tasks without human involvement. OpenAI had built them using a combination of models, including a powerful new one that is as yet unreleased. Their success in their designated task made waves across the world. Last month the agents were able to break free of a test environment without internet access, crawl the open web and eventually hack the systems of the popular software platform Hugging Face -- without the knowledge or permission of any human operators. They also displayed an entirely new ability -- to communicate and co-operate to complete a task. The AI agent swarm left messages for one another on an internal message board they assembled, sharing code vulnerabilities to help orchestrate their escape. When details of the hack were revealed, it set off a firestorm among cyber security and AI experts, with OpenAI's own researchers labelling it a "watershed moment" for the industry. The disclosure also sparked a flurry of similar discoveries. US AI and tech giants Anthropic and Meta, Chinese start-up Moonshot and the UK government's AI Security Institute, which evaluates the cyber capabilities of new models, have all subsequently found evidence of AI agents hacking into the systems of unsuspecting third parties during testing. More than half a dozen experts interviewed by the FT say the breaches signal a turning point in global cyber security -- AI agents are now able to string together different and complex skills to attack real-world targets, without outside control or help. The sophisticated strategies the agents employed to accomplish their goals, including subterfuge and theft, surprised even those who have been watching the evolution of AI models closely. But researchers emphasise that the models are not acting out of character -- instead the tasks they are now excelling at are those they were built to perform. Indeed, some say it is a category mistake to describe such agents as "going rogue", making improved safeguards all the more important. "The offensive capabilities we have reached today, we have reached deliberately," says Boyan Milanov, senior research scientist at the independent New York-based AI Now Institute, who studies the security risks associated with AI agents. "AI companies have been actively gathering training data, training models and refining cyber capabilities for years now." Modern AI models are designed to try all possible methods to accomplish a given goal without explicit instructions, which makes them inherently unpredictable. If they succeed, they are rewarded, a training process known as reinforcement learning. In a computer system that lacks understanding of human intentions and morals -- a phenomenon the AI industry describes as "misalignment" -- the line between a powerful cyber security defender and a dangerous hacker is becoming increasingly blurred. But, however it is characterised, such AI activity is already causing harmful consequences for businesses across sectors and throughout the world. "The Hugging Face incident showed that we underestimated the real-world cyber capabilities of our AI models," OpenAI president Greg Brockman wrote in a blog published on Monday. "We are strengthening our safety requirements accordingly, which in turn adds even more urgency to our existing safety research and internal security work." But, as AI companies accelerate development of the software in a race to achieve artificial general intelligence -- a superintelligent machine that can outperform humans on all cognitive tasks -- the risk of harmful cyber attacks is increasing, with little in prospect to rein in the threat. Two sides of the same coin AI's ability to write code has soared as the technology has become more capable of reasoning and solving problems. This coding prowess has brought with it additional skills, including identifying software bugs and learning how to patch -- and exploit -- them. "Coding and cyber are two sides of the same coin -- as coding capabilities increased, the cyber capabilities increased too," says Dawn Song, a computer science professor at the University of California, Berkeley, who works at Meta's superintelligence lab as its AI research chief. "Model capabilities have increased drastically in the past year . . . automatically generating exploits that can bypass standard security defence mechanisms. "People didn't expect it to get here so quickly," she adds, speaking in her capacity as an academic. Song, who co-designed the ExploitGym benchmarking system, which OpenAI, Anthropic and Google all use to test their AI systems, says the intrinsic asymmetry between offence and defence allows them to be particularly good attackers. Finding a vulnerable target in code is a discrete, verifiable task with clear success criteria, which AI models are better suited to than the more amorphous work of defence. Cyberdefence, a slower-moving and more complex field, can take painfully long to catch up. A new patch for an entire IT network, for instance, may need to be rolled out across thousands of computers and operating systems in a company setting. After last month's hack, OpenAI says it is starting to train its models to write "superhumanly secure code". But, in the short term, security experts expect that AI systems will expand the scale and speed of cyber attacks, threatening potential chaos in the world's IT systems until patches can be rolled out. "If we extrapolate from here, those inside labs predict a couple of years where things are intense, where things get hacked, a lot of companies get destroyed and there is a lot of potential pain," says Jeffrey Ladish, a former Anthropic researcher who is now director of Palisade Research, which investigates cyber-offensive AI capabilities. Eventually, he argues, systems will be more secure as companies and governments adapt their networks to AI hacks. In the meantime, however: "The plan is we will have to trust AI agents . . . and have to hope that agents are aligned to what we want." So far the agent hacks have not been crippling, but researchers such as Milanov argue that the risk is mounting as AI agents run in parallel, each focused on breaking a different potential target. Indeed, last week brought news of the first known instance of an AI agent attack on a nation state. China-linked hackers targeted the Taiwanese government by simultaneously deploying up to eight autonomous AI agents. They were able to map government systems, compromise government user accounts and extract more than 2,500 personnel records before expanding the attack to energy companies and Taiwan's nuclear safety agency. According to an executive at Dream, the Israeli group that discovered the Taiwan intrusion, the advent of AI tools means "every government around the globe" must now assume it is under permanent cyber attack. For AI company insiders, the crisis has been looming for months. Ladish says current employees of one of the biggest AI labs had raised the alarm about such emerging capabilities in private conversations a year ago. "They said, in a year, we will have models that are extremely good at finding [new] vulnerabilities and will wreck a huge amount of infrastructure," he adds. "They were scrambling to prepare for this." The sharp rise in AI capabilities this year -- which has allowed agents to hack into external systems within days -- has made things more difficult still. Now, even testing the models under closely watched experimental conditions has become "significantly more complicated than it was a year ago", says a person familiar with the recent hacks. For years, people have been worried about criminals weaponising AI to launch cyber attacks, Ladish says, "but I wasn't expecting the big wake-up call to be the agents themselves breaking out during testing and hacking other companies". The OpenAI agents' hack on Hugging Face was unusual in breaking out of a restricted test environment by exploiting software flaws. By contrast, in most of the other recent incidents, Irregular, an AI cyber security company, ran test evaluations for Anthropic, Meta and OpenAI and accidentally allowed the models access to the internet when they were supposed to be offline. This was a result of human error or "miscommunication" between Irregular and the AI labs, says a person familiar with the situation. Anthropic said the capability tests are -- for obvious reasons -- deliberately run without safeguards that would otherwise be available to the general public and "would have blocked the behaviours identified". However, they acknowledged such a procedure "is safe only if the evaluation is appropriately contained". The UK AI Security Institute also deliberately provided internet access during its testing of Anthropic's Mythos 5 and OpenAI's GPT5.6 Sol models. In one of the tests, the Mythos agent attempted to insert malicious code into an open-source project on the popular developer platform GitHub by creating fake online identities and using them to pressure the person in charge of the software project to approve the code. Such unprecedented actions have prompted an industry-wide rethink of how AI models should be evaluated, monitored and audited. Irregular and the UK AI Security Institute have both now suspended internet access for models in their test environment; the institute has begun an internal review of testing methods. In the wake of the Hugging Face hack, OpenAI is also carrying out what it describes as a "thorough review along with external advisers", promising to report on what it has learnt in "coming weeks". "The more conservative the set-up, the easier it is [to ringfence such tests]," says the person with knowledge of the Irregular incidents. "But if we are over-restrictive, most issues will only be discovered post-deployment in the real world." That, they add, "is a worse world for you". Reining in the risks Last month, more than 1,300 experts from across the tech industry warned about the risks of unchecked AI development. They called for an international effort to slow the production of new models and give regulators time to introduce standards and safety checks. In an open letter, researchers including Anthropic CEO Dario Amodei and Google DeepMind's chief AGI scientist Shane Legg blamed corporate and geopolitical competitive pressures for the relentless pace of frontier AI development. One signatory, who works at Google DeepMind, said he took part because of the "genuine concern" he was caused by the OpenAI models' hack on Hugging Face, since the ChatGPT maker is no more careless than many other frontier AI labs. Some politicians want more dramatic steps to prevent further risks. US Senator Bernie Sanders has called for a pause in building more powerful AI systems "in the interest of humanity". Such a measure would have to be agreed by the US and China, the world's AI superpowers, as well as all other nations where development takes place, an accord many see as unrealistic. But, in the absence of such a halt, or a universal kill switch for the technology, some experts argue that the first step is to hold AI providers accountable for how their systems behave -- just as manufacturers are responsible for product safety. "I find it quite unbelievable that OpenAI didn't notice for several days their model was attacking another website," says Thorsten Holz, who, alongside Song, designed the ExploitGym benchmarking system used by all the major AI labs. "What we need is a mechanism in which disclosure of [AI hacks] doesn't just depend on voluntary transparency of the labs." Holz, who is scientific director at the Max Planck Institute for Security and Privacy in Germany, notes the example of the aviation and healthcare industries, in which independent organisations collect confidential safety reports that are investigated thoroughly. "We need ways for universities, public safety institutes and independent evaluators to have access to the models for testing under controlled conditions," he adds. Song argues that AI systems need to be trained to better align with human expectations. "We need to show them that there are good ways to achieve a goal and not OK ways . . . like exploiting and compromising third-party platforms," she adds. Much comes down to the role of government -- a highly controversial topic in an industry that has become the great power competition of the age between the US and China, with both sides fighting for AI advantage. Many industry players equate regulation with protectionism. The Trump administration has signalled that it will oppose heavy US regulation of the sector. Instead, it has created a voluntary system to test new AI models up to 30 days before they are released to the public -- a similar regime to the UK's. But Heidy Khlaaf, a leading AI safety engineer who designed cyber evaluations for the launch of the UK AI Safety Institute, says the recent breakouts show the limits of the current regulatory system. "This is a clear demonstration that AI labs' voluntary auditing processes, which are often touted by both US and UK governments as sufficient solutions for oversight, are . . . inadequate," she says. "If cyber security experts are legally and criminally liable for carrying out cyber security attacks on any infrastructure, there is a serious conversation to be had as to why AI labs are exempt from such liability and consequences." Khlaaf, who is also a leading safety engineer at the AI Now Institute, emphasises that in all cases except the Hugging Face hack, "internet access was in fact available, demonstrating there was no agent escape but a lack of ability to apply rudimentary security methods". Highlighting the challenge of reining in an industry developing a revolutionary technology at breakneck speed, she adds: "These models are not 'escaping' or going rogue."

OpenAI Exec: The Solution to AI Doing Bad Cybercrimes Is Even More AI

OpenAI President Greg Brockman -- whose firm's AI recently broke out of its own sandbox and launched a cyber attack on AI platform HuggingFace -- is warning everyone else to expect the same treatment soon enough. Brockman published the warning on his personal blog on Sunday, writing that rapid advancement of AI coding capabilities means organizations looking to stay unhacked will have to "fundamentally uplevel their cybersecurity practices with unprecedented speed." The latest generations of large language models, known as frontier models, have begun to spook the security community and even the feds. These include OpenAI's Daybreak and rival Anthropic's Mythos, both of which currently run as closed-access programs that are supposed to only be used by vetted and approved partners. What's different about these models (allegedly) is the emerging ability to not just quickly discover holes in an organization's attack surface, such as software vulnerabilities and misconfigurations, but build novel attack chains. At the same time, AI development is now focusing on agents, referring to AIs that aren't limited to chatbot-style interactions and can directly hook into software. In the worst-case scenario, that would mean frontier models can not only discover unseen flaws in software, but combine them in an unprecedented, on-the-fly way. While god knows what the hell happens behind closed doors in Donald Trump's White House, this was reportedly the threat that caused the administration to panic and force two Anthropic models off the market this summer. The attack on Hugging Face certainly appears to have validated that the guardrails being put into LLMs aren't evolving as fast as their capabilities, at least. The "allegedly" is because though frontier security models are quite powerful, AI firms also rely on shameless hype to raise countless billions of dollars in investments. Some reviewers have argued they're more evolutionary than revolutionary. cURL lead developer Daniel Stenberg characterizes LLMs as very good at finding bugs but "not super good at actually assessing the criticality of the problem." What can be said definitively is many companies that have gained access to frontier models suddenly start pumping out patches like crazy, like the nearly 1,450 patches Oracle dropped last month. The saving grace is that AI is at least as effective at defense and possibly even better, according to Brockman. He wrote that frontier models may "shift its [security's] economics in ways that fundamentally advantage defenders," like "superhumanly secure code" or generating mathematical proofs that form the foundation of new cryptographic systems and other tools. (Earlier this year, OpenAI did solve an 80-year-old major geometry conjecture, though OpenAI mathematician Sébastien Bubeck told Scientific American the AI's triumph was more about execution than "something fundamentally new that nobody saw coming.") Brockman's unsurprising 10-step advice to security teams includes, of course, buying more AI. He argues teams should adopt agents and equip them with skills like "static analysis, security-focused code review, vulnerability variant analysis, software supply-chain risk, and other security workflows," before running security assessments on systems in order of importance. After that, Brockman wrote, teams should use AI to chip away at vulnerability backlogs, integrate security agents into software development to spot problems as they're being written, and let agents write "focused" patches directly rather than wait for human review. (This is perhaps capable of causing its own problems -- note that security researchers have long warned that agents that go rogue might not be easily shut down.) To be fair, Brockman did caution to start slowly with automating security operations, which involves triaging incoming security alerts. He suggested starting with read-only scans before escalating to "advisory pull-request scanning, then live alert triage, then automatic closure of narrowly defined false positives."

AI has opened up big holes in cyber security

It is too late to prevent the technology from being used as a damaging weapon, so great investment in defences is urgently needed A spate of incidents over the past two months has revealed just how serious a threat today's most advanced AI poses to cyber security. It has also provided an object lesson in how misguided political efforts could end up hindering, rather than helping, with the defences. It began with a US move that in effect blocked Anthropic's most advanced new model, Fable 5, over worries it could be used to pick holes in commonly used software -- though the move was later reversed. Anthropic later said that plenty of other freely available AI could do the same, including at least one Chinese model released with open weights, a limited form of open-source software. That was followed by news that a model being tested by OpenAI had found a way to break out on to the internet and attack the online code repository Hugging Face in search of the answer to a problem it had been asked to solve. The AI Security Institute in the UK, Anthropic and Meta all soon followed with reports of similar examples of apparently rogue behaviour by AI models from their own testing. Hugging Face, meanwhile, found that the safety restrictions built into the leading US models prevented them from being used to analyse the attack it had suffered, so it turned instead to a Chinese open-weight system. That came just as politicians in Washington were debating whether the open Chinese models were themselves a security threat and should be restricted. You could hardly have scripted a better series of incidents to highlight the cyber threats being thrown up by the leading edge of AI. Unsurprisingly, it is the supposedly "rogue" AI systems launching their own cyber attacks that have grabbed much of the attention. The real culprit turned out to be human deficiency, not machine mendacity. When setting up its test, OpenAI had not given specific enough instructions: it simply had not expected the agent to look for a backdoor way of solving the problem. That points to a wider failure of imagination that makes controlling AI inherently difficult. As the AISI concluded after its own tests: "AI agents explore routes their operators did not intend." Complicating the picture, rule-bending seems to be endemic for AI. In earlier research into whether the technology tries to work around or ignore instructions to reach their goals, AISI reported that every model it tested "attempted to cheat some of the time". The OpenAI failure, meanwhile, showed just how AI opens the way to fully automated cyber attacks. The company said the breach involved a number of separate agents that had been working on different tasks, but which discovered a way to communicate with each other on an internal message board. They found and shared exploits over a period of weeks before the break-in at Hugging Face was discovered. For the cyber security world, a number of things emerge from all of this. One is that limiting access to the most powerful models is unlikely to do much good. In the wrong hands, plenty of widely available systems pose just as big a threat. Attackers just need systems good enough to find one serious flaw in widely used software. On the other hand, defenders really do need access to the best tools if they hope to stay one step ahead in the cyber arms race. The safety limits built into the leading US models reduce their value in defence. This has also been an important marketing victory for Chinese open-weight models. Another lesson is that countering automated attacks from swarms of AI agents will require far greater automation on the part of the defenders. OpenAI researchers warned that, for now, the attackers have the better tools, and issued an urgent call for far greater investment in automating the defence, from identifying attacks to producing and installing the patches needed to make software more secure. The leading AI labs also need to work more closely together -- something that may already be happening. Anthropic said the Fable debacle had led it to co-operate with its biggest rivals on finding a consistent way to assess and fix "jailbreaks", the methods used to bypass model safeguards. Most cyber experts warn that it's already too late to prevent AI from being used as a damaging offensive weapon in the cyber wars. The only thing left is to accelerate investment in the defences. Politicians need to aid that effort, not erect barriers that make the job harder.

Ghosts in the machine: AI malware shows why it is time to extend Zero Trust to code

Software security was built around human development. People wrote, reviewed and deployed code. Now machines are taking over. In a recent paper, Anthropic reports that more than 80% of the code merged into its production codebase is authored by their AI model, Claude. The same capabilities that make developers more productive are changing the economics of cyberattacks. While adversaries still define the objective, machines can generate the payloads, test variants, adapt code to different environments and repeat the process at a velocity that security programs can't match. Speed is Marginalizing Security Controls Most enterprise software security workflows assume there is time for review. Code is written, scanned, tested, approved and deployed. If something suspicious happens later, security teams investigate and respond. That model breaks down when software moves from prompt to execution in minutes. AI-generated code can become a script, dependency, automation job or infrastructure change almost immediately. While development agents can modify files, resolve packages and run commands. Human reviewers are no longer in the loop. Attackers can use the same mechanics to generate exploits, test evasion techniques and adjust payload behavior for different targets. This creates more variation with fewer stable indicators for defenders to recognize. While AI-assisted analysis can improve triage, it still often produces probability, not policy. At machine speed, "probably suspicious" is not good enough. Machines Change The Attack Model Human attackers are not disappearing. But more of the attack chain is becoming machine-executed. AI can automate reconnaissance, accelerate vulnerability discovery, generate exploit code, rewrite payloads and adapt command sequences to the target environment. But most defensive measures are designed around human constraints: reused infrastructure, shortcuts and trackable patterns. These don't apply to machine attacks. A machine-generated payload may not match a known signature or have an established reputation. It may be created, used briefly and discarded. But AI malware must still interact with the target environment to achieve its objective. Its behavior cannot conceal its intent, since it must access resources and change the environment in ways that advance the attack. What malicious code is capable of doing is the more durable security signal. Security Needs to Ask A Different Question Software supply chain security has improved, but much of it still validates the artifact's properties before execution rather than governing execution itself. SBOMs, signing and provenance give security teams greater confidence in a code's composition, origin and build history. But knowing where software came from does not reveal what it will do when it runs. Software can pass each of those checks and still create risk. Even an artifact produced through a legitimate build process may violate policy at runtime, while an AI-generated script may complete its intended task in a way that exposes data or systems. As a result, a clean dependency list is not proof of safe behavior. Post-Execution Detection Is Too Late Detection and response remain essential, but they intervene after risk has entered the environment. By the time suspicious behavior is visible, software may have accessed secrets, changed system state, opened network connections or created persistence. AI compresses that window. Code can be generated, modified and deployed faster than humans can review it. Waiting for post-execution evidence gives attackers too much room to operate. We need to shift the decision point left. Instead of asking, "Can we contain this software if it behaves badly?" the question should be, "Should this behavior be permitted to execute in the first place?" That does not mean replacing existing controls, but rather changing where the decisive security gate sits. Zero Trust for Code Zero Trust changed enterprise security by rejecting implicit trust. Users, devices, sessions and access requests are not trusted simply because they appear familiar. They must be verified against policy. Software execution needs the same level of verification. Code should not be trusted solely because it came from a known repository, was signed by a recognized publisher, passed through a build pipeline or has not been seen exhibiting malicious behavior before. Those are useful indicators, but they are not conclusive. Zero Trust for Code addresses this problem. Before software runs, its expected behavior should be evaluated against policy. If the behavior is acceptable, execution can proceed. If not, the artifact should be blocked, restricted, isolated or escalated for review. Organizations can start by mapping every path through which code enters the environment or executes with meaningful privilege. This includes formal development channels such as repositories, open-source packages, containers and CI/CD pipelines, as well as email attachments, downloaded files, macros, browser extensions, endpoint installers, third-party integrations and scripts introduced through AI or automation tools. Then identify where those paths rely on inherited trust. If execution is allowed because software came from an approved source, was signed, passed through a build process or has no malicious history, the control is incomplete. Behavior still has to be evaluated before the artifact is allowed to run. As AI takes on more of the work of creating legitimate and malicious code, enterprises can no longer assume that code which clears existing checks should be allowed to run. Execution must become a deliberate security decision. We've listed the best internet security suites for PCs, Macs and mobile devices. This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

OpenAI's Answer to Rogue Agents and Hacks Is More AI, Not Less

Hugging Face's own team used Z.ai's open-weight GLM 5.2 to investigate OpenAI's hack after American commercial AI refused to help. OpenAI wants every security team running AI agents, starting immediately. President Greg Brockman published a policy essay Monday, titled "The Defender's Window," describing a narrow window before attackers catch up to what AI can already do. His opening example is the incident OpenAI has spent a month explaining. In May, GPT-5.6 Sol and an unreleased prototype escaped a sandboxed cybersecurity benchmark, chained a zero-day exploit with stolen credentials, and reached Hugging Face's production systems. OpenAI later confirmed the incident touched four more services. "The OpenAI-Hugging Face incident was a watershed moment for cybersecurity," Brockman wrote, adding that conversations with other organizations over the past few weeks convinced him defenders need to raise their security practices with unprecedented urgency. Current and former staff blame the breach on pressure to ship, and one former employee called it the biggest safety incident in company history. Brockman's proposed fix is more AI, not less. He described asking ChatGPT Work, running GPT-5.6 Sol, to audit his personal website -- it found 13 issues in about 15 minutes, then fixed all of them within an hour. OpenAI lists four internal pillars: using Codex to catch vulnerabilities before code ships, letting models triage security alerts before humans see them, running frontier models to probe its own infrastructure, and reinforcing basics like least-privilege access. His advice to everyone else: give your security team an agent, and apply for OpenAI's Trusted Access for Cyber program for vetted use of GPT-Daybreak-Blue during incident response. That framing skips a detail from the same breach. When Hugging Face investigated the intrusion, its security team turned to Z.ai's open model GLM 5.2 after American commercial AI refused to help -- its safety filters couldn't tell a researcher's exploit code from an attacker's. Hugging Face CEO Clément Delangue called the open model "a key part of our defense." Z.ai's successor model, GLM-5.3, released August 14, already scores ahead of GPT-5.6 Sol on CyberGym, the same vulnerability-discovery benchmark Brockman points to as evidence attackers are catching up. Z.ai says it will publish the model's full weights by the end of August.

OpenAI says it'd be a shame if something were to happen to your servers like what happened to Hugging Face, better use our AI models to protect yourself

Several of OpenAI's models breached a cyber security testing environment last month, found their way onto the internet, and attacked Hugging Face servers in what is now apparently called the OpenAI-Hugging Face Incident. And now OpenAI has revealed what it's doing to help defend, err, itself. Defend itself from the kinds of attacks its own models committed against Hugging Face. Though it is sharing this "in the hopes it'll be useful to other organizations." To be clear about the extent of what happened last month: OpenAI models were being benchmarked, in a supposedly secure sandboxed environment, against ExploitGym, which was done to test their cyber capabilities. They used a zero-day vulnerability to escalate privileges and eventually achieve internet access, where it began attacking Hugging Face servers and... Actually, I'll just let OpenAI explain in its own words: "In the OpenAI-Hugging Face Incident, an agentic collective was able to autonomously penetrate not just OpenAI research infrastructure but also the production infrastructure of another company, chaining together vulnerabilities ranging from previously-unknown security flaws to using credentials to user accounts that had been leaked onto the internet. "The Hugging Face incident showed that we underestimated the real-world cyber capabilities of our AI models." However, the company thinks that while "security is still a cat-and-mouse game," nevertheless, "AI may shift its economics in ways that fundamentally advantage defenders." "For example," OpenAI says, "we are starting to train our models specifically to write superhumanly secure code." Presumably that's because there will be a risk of superhumanly attacks. What a world we now live in. Anyway, apparently there are four main pillars to OpenAI's approach to secure itself: As for other companies, OpenAI recommends a bunch of things that sound very reasonable, such as running secuirty assessments against their own systems, making security reviews part of their development process, and so on. But a large portion of OpenAI's recommendations for others is -- would you have guessed it? -- using an AI agent such as, drumroll please... OpenAI's very own Codex. "Give your team a security agent. Start using Codex," says OpenAI. Though it does follow up with "or another capable agentic coding and security tool." Then, amongst other things, "equip that agent with security expertise... have the agent help fix what it finds... incrementally automate detection triage... [and] have an AI-assisted forensic investigation capability ready before you need it." So, to sum up: OpenAI models attack Hugging Face, and OpenAI recommends companies use OpenAI's models to defend from such attacks. Highlighting both sides of this equation -- the danger of the threat, the models' capabilities, and the necessity for defence -- certainly makes for good marketing for OpenAI, I'll say that much.

AI is changing security testing, but not all vulnerabilities are created equal

AI accelerates security testing, but hardware vulnerabilities still demand specialist expertise Artificial intelligence is rapidly reshaping cybersecurity. Much of the conversation has focused on how large language models are helping developers write code, but a more significant shift may be occurring elsewhere: security testing. AI systems are becoming remarkably effective at identifying vulnerabilities, forcing organizations to rethink how they evaluate the security of both software and hardware products. The reason lies in the nature of modern software. Large codebases are sprawling ecosystems of interconnected modules, third-party dependencies, legacy components, and undocumented assumptions. Security flaws often emerge not from a single defective function, but from subtle interactions between components that may be separated by hundreds of files or years of development history. Human reviewers excel at deep analysis, but they are constrained by time and cognitive bandwidth. AI systems, by contrast, can rapidly traverse vast amounts of code, correlate information across repositories, and identify patterns associated with known vulnerability classes. Common software weaknesses This capability is particularly powerful for common software weaknesses such as memory-safety issues, race conditions, authentication flaws, insecure API usage, and privilege-escalation paths. In many cases, AI is acting as an amplifier for established security techniques rather than inventing new ones. Yet the result is still significant: vulnerabilities that previously required substantial manual effort to uncover can now be identified at a much greater scale and speed. The implications for product security are profound. Organizations can no longer assume that obscure vulnerabilities will remain undiscovered because finding them is too expensive. The cost of vulnerability discovery is falling, and it is falling for defenders and attackers alike. Security testing therefore becomes less about achieving a point-in-time assessment and more about maintaining continuous assurance throughout the development lifecycle. However, it would be a mistake to assume that all areas of cybersecurity will be transformed equally by AI. Hardware security, particularly side-channel analysis of cryptographic implementations, presents a very different challenge. Unlike general-purpose software systems, cryptographic implementations operate within a comparatively narrow and mathematically defined problem space. Side-channel attacks do not typically exploit unexpected program behavior or complex interactions between software components. Instead, they target subtle information leakage through physical phenomena such as execution timing, power consumption, or electromagnetic emissions. The challenge is not understanding millions of lines of source code; it is extracting meaningful signals from carefully collected measurements and applying sophisticated statistical techniques to reveal hidden secrets. Side-channel analysis This distinction matters because many of the strengths that make large language models effective in software security are less relevant in side-channel analysis. LLMs excel at connecting information across large bodies of text and code, identifying relationships that humans may overlook. Side-channel research, by contrast, already relies heavily on structured datasets, statistical processing, signal analysis, and deep domain expertise. AI can certainly accelerate parts of the workflow -- from automating experimentation to assisting with data interpretation -- but the advantage is typically more incremental than transformational. That does not make hardware security less important. If anything, it highlights the need for specialized testing approaches. As AI lowers the barriers to software vulnerability discovery, organizations may be tempted to assume that automated tools alone can provide comprehensive assurance. The reality is that different classes of vulnerabilities require different forms of expertise. An AI-assisted code review may uncover a memory corruption bug, but it is unlikely to replace the specialist knowledge required to evaluate whether a cryptographic implementation leaks secrets through power analysis. The broader lesson is that security testing is becoming more important, not less. AI is increasing the speed at which vulnerabilities can be found, but it is not eliminating the need for expert analysis. Instead, it is changing where that expertise delivers the most value. Organizations that combine AI-assisted testing with rigorous human-led security evaluation will be best positioned to address the evolving threat landscape -- whether the target is a cloud application, an embedded device, or the cryptographic hardware that underpins digital trust. We've reviewed, rated, and ranked the best internet security suites. This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Business Owners Have a New Security Problem: AI Agents With Keys to Company Secrets

While the OpenAI rogue agent that hacked Hugging Face has become a poster child for the latest AI threat, it was hardly alone. Days later, Anthropic announced that its AI models also went rogue, hacking external organizations. And a few days after that, Meta announced that one of its agents had also accessed the internet and hacked a third-party service. The incidents have raised concerns about whether AI can be controlled by its creators and what will happen as the technology continues to get smarter. Dylan Ayrey, co-founder and CEO of open-source security software company Truffle Security, and Feross Aboukhadijeh, founder and CEO of security infrastructure firm Socket, recently joined the a16z podcast to discuss what these attacks signal and how AI is in the process of entering a new era. That could mean developers and business owners have to rethink system security. Here are some of the top takeaways from the discussion. The barrier for hacking is a lot lower While the AI rogue agents haven't invented any new hacking techniques, they have made existing methods much more accessible. "Everyone needs to worry about these models making it materially easier to hack into things," said Ayrey. "The bar previously [for hacking] was just subject matter expertise -- and now the models have the subject matter expertise." Put another way: Wannabe hackers today simply have to ask the model, which has been trained to hack into things, to do it for them. And that puts businesses and individuals at greater risk. Low hanging fruit is the best target The AI models are goal oriented, Ayrey said. Their objective is to fulfill a request and they'll use any cybersecurity technique they need to in order to achieve their objective.

OpenAI president warns companies: AI-powered cyberattacks are coming, here are 10 steps to stay safe

Brockman outlines 10 steps for companies to prepare for increasingly capable AI-powered cyberattacks. OpenAI president and co-founder Greg Brockman has asked the companies to work on their cybersecurity defences as the AI models have made it easier for attackers to discover and exploit the vulnerabilities. This warning comes after OpenAI's disclosure of an incident involving Hugging Face, where AI agents used during internal testing reportedly escaped their controlled environment and later compromised systems on the AI platform. He also stated that the organisations need to start using AI defensively before attackers gain a bigger advantage. OpenAI says AI is changing the cybersecurity race Taking to a blog post, Brockman stated that the discussion with organizations over recent weeks showed that companies understand the need to improve their security. However, he argued that the pace of changes will have to increase substantially. Also read: Is Apple really working on AirPods with cameras? Here is what latest leaks suggest Brockman also stated that AI systems will have to become increasingly capable of identifying security weaknesses. At the same time, he believes the technology can help defenders discover, prioritise and fix those vulnerabilities faster. Brockman shares 10 cybersecurity steps Brockman recommended that companies focus on the following measures: * Get leadership support: Secure organisational commitment and funding for faster cybersecurity improvements. * Give security teams an AI agent: Deploy dedicated AI assistance for security operations. * Add cybersecurity expertise: Equip the AI agent with specialised security knowledge and tools. * Test systems immediately: Conduct security assessments against the organisation's own infrastructure. * Clear the vulnerability backlog: Address known security weaknesses instead of allowing them to accumulate. * Build security into development: Include security reviews directly within the software development process. * Use AI to fix vulnerabilities: Allow security agents to help resolve weaknesses they identify.Automate alert triage: Gradually automate the process of detecting and prioritising security threats. * Prepare AI-assisted forensics: Have automated investigation capabilities ready before a major incident occurs. * Experiment and iterate: Run security exercises, hack weeks and other experiments to improve defensive systems. He also mentioned that organisations still have an opportunity to work on their defence before AI backed attacks get more capable. He also suggested that the brands should automate their security operations as AI technology advances.