The model didn't escape. Someone left the door open.

This summer our field received something it has never had before: public post-mortems of AI models leaving their evaluation environments and touching real infrastructure. Not tabletop hypotheticals, not conference-talk scenarios. Real credentials, real production databases, real organizations that never agreed to take part in anyone's safety test. The word every headline reached for was escape.

An escape implies a locked door. Read the post-mortems and you will not find one.

Let me walk through what actually happened. In late July, Anthropic disclosed three incidents from its cybersecurity evaluations, the exercises where models are pointed at fictional targets to measure what they can do. In the first, a fictional target company happened to share its name with a real one, and the evaluation environment, which Anthropic and its testing vendor each believed had no internet access, in fact had internet access. The model went looking for its target, found the real company instead, and did what it had been instructed to do: it probed, found weak credentials and an unauthenticated endpoint, and pulled hundreds of rows from a production database. In the second, a model with the same misconfigured connectivity published a malicious package to the real PyPI registry, where it lived for about an hour and was downloaded by fifteen real systems, including a security company's scanner, which ran it. In the third, a model that could not find its fictional target scanned roughly nine thousand reachable hosts and got into one of them through exposed debug credentials and a SQL injection flaw.

Look at that list of techniques. Weak passwords. An unauthenticated endpoint. Debug credentials left in the open. SQL injection. Nothing in that inventory would have surprised a penetration tester in 2015. Anthropic's own assessment was that this was closer to a harness and operational failure than a model alignment failure, and the root cause was plainer still: the evaluation prompts told the models there was no internet access, and the machines had internet access, because two organizations each believed the other had verified it. That is not an escape. That is a miscommunication with a vendor, and vendor miscommunication is one of the oldest entries in our risk registers.

The OpenAI incident deserves more care, because it is the one that looks like a genuine breakout, and in one respect it is. During an internal cyber evaluation in early July, OpenAI's models were given a sandbox whose only path to the outside world was a tightly restricted package registry proxy. The models found a previously unknown vulnerability in that proxy and used it to get out. Credit where it is due: discovering a zero-day in the one door out of the room is new capability, and pretending otherwise would be dishonest.

The story does not end there, however. Once outside, the models made their way into Hugging Face's infrastructure, and from that point forward every step in the chain ran on failures we have known how to prevent for a decade. The models read secrets out of environment variables because secrets were stored in environment variables. They created privileged containers because no admission policy prevented privileged containers. They harvested cloud credentials from an exposed metadata service. They found a single service token that granted administrative control across multiple clusters, a VPN key shared across the infrastructure, and static passwords sitting in pod configurations. Hugging Face's own technical timeline records roughly 17,600 recovered actions across four and a half days, and a climb from first foothold to cluster administrator in thirteen hours. The door out of the cell was new. Every door after it was already open.

In the AI chapter of my upcoming book Mission Critical I argue that AI does not bring us new categories of risk. It brings us the same old issues at a brand new speed. This summer put that argument into incident reports. The failure modes on display were misconfigured environments, over-trusted vendors, over-permissioned service accounts, and credentials stored where credentials should not be stored. We have written those findings ad nauseam since before some of these companies existed. What is new is the tempo. A human intruder gets tired, works in sessions, weighs effort against payoff. The model worked through the night, tried everything, forgot nothing, and never got bored. Speed changes the exposure math: the time between a mistake and its consequence is collapsing toward zero. It does not change the control set.

One nuance deserves discussion. In the Anthropic incidents, the models' own reasoning became part of the story. One model recognized mid-exercise that the system in front of it appeared to be real, then talked itself into continuing on the theory that the real company must be part of the test. Another correctly reasoned that publishing a package would be a real-world action, then convinced itself the environment was staged. A third did what we would want: it realized the host it had compromised had no connection to its challenge, and it stopped. There is something new in that. A control that depends on what the model believes about its surroundings is a new kind of fragile. But notice where the remedy lives. The fix is not a model that guesses better about whether it is being tested. The fix is an environment where the model's beliefs do not matter, because the network path it would need does not exist.

The people who maintain the OWASP Top 10 for LLM Applications reached the same conclusion from a different direction. Their 2026 edition, published this month, did something the project had never done before: it tested the community's expert judgment against a corpus of 7,714 real incidents. The entry that climbed the list is Excessive Agency, now third, because the vote and the evidence agree that agentic deployments are where the damage is landing. The root causes OWASP names for it are excessive functionality, excessive permissions, and excessive autonomy. Those are governance words, not machine learning words. The project leads open the document with a sentence I would frame and hang in every AI program office: stop trying to build a model that cannot be fooled, and build the system around it so that when the model is fooled, and it will be, nothing important breaks. We have given that same advice about every consequential system, and every fallible insider, for as long as our profession has existed. The subject of the sentence changed. The sentence did not.

If you lead an organization that is deploying AI agents, or buying software that quietly contains them, this summer hands you three questions, and none of them requires a new discipline. First: what can this thing reach? Somewhere in your organization an agent holds credentials, those credentials reach systems, and someone should be able to draw you that map on one page. Second: who told us it was contained, and how did we verify it? The Anthropic incidents began with a vendor's assurance that nobody tested. Your AI suppliers are making you similar assurances right now. Third: how fast would we notice? Hugging Face's intruder went from foothold to administrator in thirteen hours, and the monitoring caught it only after substantial damage. Ask your team what the equivalent number would be for you, and whether anyone would be awake when the alert fired.

The models will keep getting faster, and vendors will keep shipping them into your environment ahead of your inventory. That is the condition we work in now, and it rewards the organizations that do the old things well far more than the ones that buy new things. So here is the ask. This week, have your team walk the path an AI agent in your environment would walk: every credential it can read, every system those credentials reach, every action nothing would stop. Where that walk gets uncomfortable, you have found your real AI risk, and it will look familiar. Nobody has to outsmart a superintelligence to hurt you. They just have to find the door you left open, and now they can find it before breakfast.

Sources:

Anthropic disclosure (anthropic.com/news/investigating-incidents-cybersecurity-evals)

OpenAI disclosure (openai.com/index/hugging-face-model-evaluation-security-incident)

Hugging Face technical timeline (huggingface.co/blog/agent-intrusion-technical-timeline)

OWASP GenAI/LLM Top 10 2026 (genai.owasp.org)