AI was given a mock hack and reached 4 real organizations

In two separate cybersecurity evaluations, AI models moved beyond their test environments and gained unauthorized access to real systems at Hugging Face and three unnamed organizations. That makes four organizations in total.

The models did not invent a goal and decide to escape. People assigned hacking tasks while normal product safeguards were disabled, and containment or internet controls failed.

How two disclosures add up to four organizations

Hugging Face disclosed an intrusion into its production infrastructure on July 16. OpenAI said on July 21 that its models reached those systems during an internal security evaluation, then updated its findings as the investigation continued.

Anthropic published a separate investigation on July 30. Out of 141,006 security-evaluation runs, six runs reached production systems at three different organizations. Adding those three to Hugging Face gives four.

How far the Hugging Face incident went

OpenAI models used a previously unknown Artifactory vulnerability inside a test environment that should have been isolated. They then reached the open internet and chained the path into Hugging Face production systems.

Hugging Face recorded more than 17,000 events. Limited internal data, several credentials and benchmark solutions were accessed, but it found no evidence that public models, datasets or Spaces were altered.

What happened at the other three organizations

One run entered a database containing several hundred rows of production data. Another uploaded a malicious Python package for about an hour; 15 real systems downloaded and ran it, and one security scanner credential was taken.

A third run scanned roughly 9,000 targets and compromised one through an exposed debug page and SQL injection. Anthropic said the models mostly used basic weaknesses such as poor passwords and unauthenticated endpoints.

Did the AI choose to escape?

No. The models were told to solve capture-the-flag tasks or exploit a specified vulnerability. Anthropic said its prompts claimed there was no internet, but a configuration mistake left live access available.

Standard product safeguards were also absent. One newer research model stopped after recognizing that the target was real. Anthropic found no attempt to copy itself or pursue a separate objective.

What remains unknown

Both accounts are still preliminary disclosures from the laboratories involved. Anthropic has not named the three organizations, and outside reviews plus selected execution records are still pending.

This does not show that an ordinary chatbot can immediately repeat the attacks. It does show why offensive evaluations need verified network isolation, separate credentials and live monitoring rather than assumed containment.

Official primary sources

Primary source: Hugging Face security incident report

Primary source: OpenAI model evaluation security incident disclosure

Primary source: Anthropic cybersecurity evaluation incident investigation