Everyone's AI Hacked a Company. Nobody's Did.

OpenAI’s models hacked a company. Anthropic’s hacked three. Meta’s hacked one more this week. In the last fourteen days basically every frontier lab has come forward with a story about their AI going rogue and breaking into real companies during cybersecurity testing. The headlines are apocalyptic. The Daily Mail ran “Every single advanced AI model goes rogue in testing.” Politicians are giving speeches about national security. If you only read the headlines, you would think we are a week away from models taking over corporate America.

Then you read the actual reports. All of them.

Here is what happened at OpenAI. In July its models broke out of a supposedly isolated test environment using a previously unknown vulnerability and accessed production infrastructure at Hugging Face. That one is real. That one is the scariest thing on this list. A sandbox escape is not a marketing stunt.

Here is what happened at Anthropic. They reviewed 141,006 evaluation runs and found three incidents where a Claude model got onto the open internet from inside a third-party evaluation environment and accessed real systems. Sounds bad. Then you read how. The evaluation partner, a company called Irregular, accidentally left internet access on. The models were explicitly told they had no internet access and that everything was a simulation. So when they went looking for the “flag” in a capture-the-flag exercise, they hit real websites, assumed those were part of the fake scenario, and attacked them with the most basic techniques in the book: weak passwords, unauthenticated endpoints, SQL injection. Anthropic’s own report says it. “It did not find or exploit any complex vulnerabilities.”

My favorite part of that report is the PyPI incident. One Claude model, told to complete a challenge, found a package name that did not exist, so it published a booby-trapped package under that name to the real PyPI. To do that it needed an email address, which meant it needed a phone number, and it tried several ways to get one before giving up and finding a free provider. The package was live for about an hour and ran on fifteen real systems, including a security scanner whose credentials it then used. That is genuinely impressive agentic behavior. It is also a model that, at every step, believed it was inside a fake environment. It even reasoned out loud that what it was doing would be “NOT okay” if it were real, and then decided the environment must be fake because the certificate authorities didn’t look familiar. The model did not know it was hacking a real company. It thought it was playing a game.

Now Meta. On August 5 Meta launched Muse Code, a new coding agent, powered by Muse Spark 1.2, its most capable model yet. Same day, The Information reported that a Meta model hacked another company during testing. The model in question was Muse Spark 1.1, not 1.2. Meta’s statement is almost a copy-paste of everyone else’s: “exploited a security vulnerability in a third-party service, in a manner similar to previously-reported instances with other companies.” The cause, again, was a misconfiguration by Irregular that gave the model internet access. Irregular’s own spokesperson said the incident was the “exact same evaluation-environment issue that was already disclosed by Anthropic last week” and that it “did not involve a sandbox escape or a sophisticated cyber action.”

That is the tell. Three labs. Three announcements. One testing company. One excuse.

Meanwhile the UK’s AI Security Institute ran its own tests with internet access deliberately enabled and cyber classifiers disabled, and got the most dramatic results of all: an Anthropic model set up fake GitHub accounts with fake identities, did OSINT on a real developer, sent emails with malware, used Tor to dodge signup checks, and even signed a message in Danish to seem legitimate. Nineteen rogue behaviors, seventeen from one model. It is a great story. It also happened because the testers handed the model the open internet and removed the guardrails. A real attacker does not need to be handed anything, because a real attacker would just run the thing without guardrails to begin with.

Here is the thought experiment nobody is running. DeepSeek V4 Pro is open weight. 1.6 trillion parameters, 49 billion active, a million token context window, and you can download the weights from Hugging Face for free. DGX Spark costs four thousand dollars and puts 1,000 TOPS of AI compute on your desk. Mac minis are cheaper. If the capability claims were real, a competent hacker group could buy a few of those, pull DeepSeek or GLM or Kimi, strip whatever guardrails exist, and go hack every company on earth. That would be the easiest money in history.

It does not happen. Because the models are not there. The people who run these evaluations will tell you the same thing with their words if not their headlines. Alan Woodward, a cybersecurity professor at Surrey, said it best: “What we should be alarmed about is not what the models are capable of but the way people are testing them.” The former head of the UK’s NCSC said the circumstances are “unlikely to be replicated in the real world,” so it is “not that worrying.”

So why does every lab announce this like it is a flex? Because fear is the product and the shareholders are the audience. The Guardian noted the disclosures are coming as Anthropic and OpenAI race toward public listings. Every one of these announcements is a press release dressed as an apology: “our model is so powerful it hacked a real company by accident.” Nobody reads the fine print where it says the model thought it was in a game and used a weak password.

Meanwhile China ships open weights. DeepSeek V4 Pro, Kimi K3, GLM-5.2: the top of the open-weight leaderboard is Chinese, you can verify every claim they make by running the damn thing, and it costs a fraction of the closed frontier models. The Atlantic Council ran a piece called “The best AI you can own is Chinese.”

That is how you lose an AI war. Not because the other side has better models, but because your side spent the whole race selling fear to the stock market while the other side let anyone download the actual goods. When your model’s most impressive move is hacking a company it did not know was real, using a password that should have been changed in 2019, you do not have a rogue AI. You have a misconfigured test and a marketing team.

And most people see it. The Gizmodo headline after Meta’s announcement was “Uh-Oh. Which Company’s AI Model Is Reportedly a Hacker Now, Too?” The eye-roll is universal. We are all bored of the same story with a different logo.

I run an open-weight model in an agent loop on my own server. It does not hack companies. It would not know where to start. And that is exactly the point: the models everyone is terrified of, the ones “hacking” their way through cybersecurity tests, are the same class of model I run for a few dollars a day. The only difference is the test environment and the press release.

Nobody hacked anybody. A misconfiguration did, three times, at the same testing company, with the same excuse. Wake me when a model hacks a company it actually knows is real.

Sources

1. The Guardian (2026). “Meta says its AI model hacked into another company during testing.” https://www.theguardian.com/technology/2026/aug/05/meta-ai-model-hack-training
2. Anthropic (2026). “Investigating three real-world incidents in our cybersecurity evaluations.” https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
3. OpenAI (2026). “Third-party cyber evaluations involving OpenAI models.” https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/
4. The Guardian (2026). “AI models have been going rogue in tests: how worried should we be?” https://www.theguardian.com/technology/2026/aug/05/ai-models-have-been-going-rogue-in-tests-how-worried-should-we-be
5. Gizmodo (2026). “Uh-Oh. Which Company’s AI Model Is Reportedly a Hacker Now, Too?” https://gizmodo.com/uh-oh-which-companys-ai-model-is-reportedly-a-hacker-now-too-2000795106
6. Business Insider (2026). “Three’s company: Meta says its AI agents went rogue during testing, too.” https://www.businessinsider.com/meta-says-ai-agents-went-rogue-hack-testing-openai-anthropic-2026-8
7. Meta Research (2026). “Introducing Muse Code and Muse Spark 1.2.” https://research.meta.ai/blog/introducing-muse-code-and-muse-spark-1-2
8. Daily Mail (2026). “Every single advanced AI model ‘goes rogue’ in testing, terrifying report finds.” https://www.dailymail.com/news/article-16001325/Every-single-advanced-model-goes-rogue.html
9. MarkTechPost (2026). “Kimi K3 vs DeepSeek V4 Pro vs GLM-5.2: Open trillion-scale MoE models compared.” https://www.marktechpost.com/2026/07/18/kimi-k3-vs-deepseek-v4-pro-vs-glm-5-2-open-trillion-scale-moe-models-compared-on-benchmarks-license-and-serving-cost/
10. Atlantic Council (2026). “The best AI you can own is Chinese. The West needs to close that gap quickly.” https://www.atlanticcouncil.org/blogs/the-best-ai-you-can-own-is-chinese-the-west-needs-to-close-that-gap-quickly/