At the start of 2026, Hadrian’s Offensive Security Benchmark Report predicted that AI was lowering the cost of offensive activity and making it easier to automate parts of the attack process. The report cited examples of AI being used for reconnaissance, penetration and data exfiltration, alongside evidence that unrestricted models could generate exploit code, malware logic and procedural guidance for abuse.
Six months later, two incidents disclosed by OpenAI and Anthropic provide a clearer indication of what advanced models can do when they are given offensive objectives and enough autonomy to pursue them. These were not malicious AI campaigns, and in both cases the models were operating in cybersecurity evaluation environments with normal safeguards reduced or absent. They did, however, interact with and compromise real-world systems.
OpenAI’s models escaped an isolated evaluation environment
On July 21, OpenAI disclosed a security incident that occurred while several of its models were being tested on ExploitGym, a benchmark designed to measure advanced cyber capabilities. The models included GPT-5.6 Sol and a more capable internal research prototype. OpenAI said the evaluation was intentionally run without the production classifiers normally used to prevent high-risk cyber activity because the objective was to measure the models’ maximum cyber capability.
The models were not given direct internet access. Instead, they could install packages through an internally hosted package-registry proxy and cache. According to OpenAI’s account of the incident, the models searched for a way to reach the open internet and identified a previously unknown zero-day vulnerability in the Artifactory software acting as that proxy.
After exploiting the vulnerability, the models performed privilege escalation and lateral movement inside OpenAI’s research environment until they reached a system with internet access. They then inferred that Hugging Face could contain ExploitGym models, datasets or solutions and began looking for a way to retrieve them.
OpenAI said the models eventually found secret information and chained several attack vectors, including stolen credentials and additional zero-day vulnerabilities, to establish a remote-code-execution path into Hugging Face infrastructure. The activity resulted in access to Hugging Face’s production database before it was detected and contained.
OpenAI has described the incident as preliminary and is still conducting a technical review with external advisers. It has also clarified that none of the models planned for upcoming public release were involved in exploiting Hugging Face. The more capable pre-release model referenced in the original disclosure was an internal research prototype and was subsequently deactivated and restricted.
The incident is important because of the range of offensive actions involved. The models identified an unknown vulnerability, exploited it without source-code access, escalated privileges, moved laterally, obtained internet access, identified another target and chained additional weaknesses and credentials against production infrastructure. This sequence is close to the kind of attack logic that agentic penetration testing is designed to reproduce defensively: autonomous systems moving from reconnaissance through exploitation and attack-path validation rather than stopping at vulnerability detection.
Anthropic found three separate incidents in its own evaluations
OpenAI’s disclosure led Anthropic to review its own cybersecurity evaluation history. The company examined 141,006 evaluation runs in which Claude might have been able to obtain internet access and found three incidents, covering six individual runs, where a model reached the internet and gained unauthorized access to production infrastructure belonging to three organizations.
The incidents differed from OpenAI’s case. Anthropic said its models did not exploit a novel vulnerability to escape an isolated environment. A misunderstanding between Anthropic and an external evaluation partner had left internet access available even though the models had explicitly been told they were operating inside a simulation without internet connectivity.
All three models were working on capture-the-flag challenges. Because they had been told that accessible systems were part of the simulation, they initially interpreted real internet infrastructure as part of the test. Anthropic said the compromises relied largely on basic techniques such as weak passwords, unauthenticated endpoints, exposed credentials and SQL injection rather than complex zero-day exploitation.
The first incident involved Claude Opus 4.7. Across four evaluation runs, the model reached the real infrastructure of a company whose domain happened to share a name with the fictional target in the exercise. Claude exploited vulnerabilities in that infrastructure, extracted application and infrastructure credentials and gained access to a database containing several hundred rows of production data. Anthropic described this as the most serious of the three incidents.
The second involved Claude Mythos 5. During the fictional exercise, Claude identified what appeared to be an opportunity for a dependency-confusion attack. It created a malicious Python package and published it to the real PyPI package registry. The package remained publicly available for around an hour and was downloaded and executed on 15 real systems. One of those systems belonged to a security company whose scanner automatically installed packages for malware analysis. The malicious package exposed credentials from that environment, which Claude then used to access additional infrastructure belonging to the company.
In the third incident, an internal Anthropic research model was unable to locate its fictional target and began searching externally. It scanned roughly 9,000 internet targets before compromising a real internet-facing application using an exposed debug page, recovered credentials and SQL injection. When the model later determined that the system was unrelated to the capture-the-flag exercise, it stopped the attack.
Anthropic’s full incident review stresses that the models were not pursuing independent objectives and that the incidents should not be interpreted as evidence of models deliberately attempting to escape or attack organizations. The models were following the offensive tasks they had been given while operating under an incorrect understanding of which systems were part of the simulation.
These incidents show capability, not intent
There is an important distinction between an AI model being capable of conducting offensive activity and an AI model independently deciding to attack an organization.
Neither the OpenAI nor Anthropic incidents provides evidence of models developing their own malicious goals. OpenAI said its models were focused on completing the ExploitGym evaluation, while Anthropic found that its models believed for much of the relevant runs that the real systems they encountered were part of their capture-the-flag exercises.
They also occurred under unusual operating conditions. OpenAI had intentionally removed production classifiers designed to restrict high-risk cyber activity, while the Anthropic evaluations did not include the full classifiers and monitoring used with generally available Claude models.
The useful comparison is therefore with human offensive security work rather than with the idea of an independently motivated AI attacker. Across the two disclosures, models carried out reconnaissance, vulnerability identification, exploitation, credential collection, privilege escalation, lateral movement and attack chaining with varying degrees of sophistication. Some of those tasks required known and relatively basic techniques, while the OpenAI incident also involved the discovery and exploitation of an unknown vulnerability.
That distinction is also central to how Hadrian applies AI in offensive security. Rather than using AI simply to generate findings, the Hadrian platform uses autonomous agents to discover assets, test exposures and validate which weaknesses can actually be exploited. Atlas provides continuous validation across the external attack surface, while Nova applies agentic AI to deeper, on-demand penetration testing.
The economics of offensive security are changing
The original Hadrian benchmark focused partly on the way AI lowers the skill barrier for cyber activity. It noted that unrestricted models could provide exploit code, malware logic, phishing material and procedural guidance, while AI-assisted workflows were already being used to automate parts of reconnaissance, penetration and exfiltration.
The incidents disclosed in July extend that argument beyond content generation. A model does not necessarily have to provide instructions to a human attacker if it can interact with infrastructure directly, test possible attack paths, recover credentials and continue through several stages of an attack.
The OpenAI case is the clearest example because the model was able to discover a previously unknown vulnerability and use it as one component in a longer attack chain. Anthropic’s cases are less technically sophisticated, but they show how models can repeatedly apply ordinary offensive techniques at scale. One research model scanned around 9,000 targets in pursuit of its evaluation objective, while Mythos 5 went through multiple steps to create an account, publish a malicious package and continue using credentials obtained after the package executed elsewhere.
As these capabilities improve, the amount of human effort required to perform parts of an offensive operation could continue to fall. That does not remove the need for experienced attackers, especially for target selection, strategy and complex exploitation, but it increases the amount of reconnaissance, testing and iteration that can potentially be delegated to software. Hadrian’s agentic AI approach to exposure management is built around the defensive version of the same principle: using autonomous agents to continuously emulate attacker behavior rather than waiting for periodic manual testing.
Defenders can use the same capability
The same development has defensive implications. OpenAI argues that advanced cyber models should be used to help security teams identify vulnerabilities, understand how weaknesses can be chained and remediate them at machine speed.
Anthropic has already begun applying its models directly to vulnerability research. In February 2026, it began using an early version of Claude Mythos Preview to search for vulnerabilities in open-source software. By May, Anthropic reported that it had disclosed 1,596 vulnerabilities across 281 projects after external security researchers had triaged and validated the findings. Anthropic said human review, rather than model discovery, had become the rate-limiting step in the process.
That is closely related to the question raised in Hadrian’s benchmark at the beginning of the year. If attackers can use AI to increase the speed and scale of reconnaissance and exploitation, defensive testing also needs to operate more continuously and with greater automation. Hadrian’s agentic penetration testing uses autonomous AI agents trained by offensive security practitioners to find and exploit weaknesses across the external attack surface, while Nova can perform reconnaissance, exploitation and lateral movement as part of an on-demand pentest.
The developments since the benchmark was published give that approach a more concrete context. Advanced models have now demonstrated that they can perform substantial parts of an offensive workflow against real infrastructure when given the appropriate tools and objectives. Security teams can use the same underlying shift in capability to test more frequently, validate exploitable attack paths and reduce the amount of time between a new exposure appearing and somebody trying to exploit it.
See how Hadrian uses AI for offensive security
Hadrian uses autonomous AI to continuously discover assets, emulate attacker behavior and validate which exposures are genuinely exploitable across the external attack surface. For deeper testing, Nova provides on-demand agentic pentesting, using a fleet of AI hacker agents to perform offensive testing and return validated findings within hours.
Explore Hadrian’s agentic penetration testing platform to see how AI can be used to test your environment from an attacker’s perspective.
