Cybersecurity and AI Agents: A Double-Edged Sword Without a Handle?

The Joint Alert from the Five Eyes Cybersecurity Agencies

On June 22, 2026, the Five Eyes cybersecurity agencies (Australia, the United States, the United Kingdom, New Zealand and Canada) issued a call to action prompted by the rapid transformation of cyber risks resulting from the introduction of AI agents across every stage of cyberattacks. The joint alert was addressed to leaders across all sectors and highlighted the acceleration and exponential increase in performance that the cyber threat landscape has experienced within just a few months.

The document’s core concepts are the dual role of AI—as both a problem and a solution—within a universal ecosystem, and the urgent need for an effective and timely response closely linked to a fundamental paradigm shift. Specifically, all stakeholders were urged to change their approach and make a definitive transition to “secure-by-design” and “secure-by-default.”

Cyber resilience, the document states, is not exclusively an IT issue, as it is essential to business continuity and trust in the global market. Companies that act now will reduce risks, strengthen resilience and consolidate the trust of customers, partners and investors. Those that delay, on the other hand, will face growing and preventable risks.

The OpenAI-Hugging Face Case and the “Exploit Race”

The urgency of the advisory was also justified by a series of major incidents reported since at least 2025. In November of that year, US company Anthropic reported the misuse of its Claude Code model by Chinese adversaries to automate large-scale intrusions. Furthermore, research published in July 2026 confirmed what has now become an established pattern, describing a Chinese espionage operation that leveraged Claude Code and DeepSeek-v4-pro against government and financial systems in the United States, Asia, Europe and Australia. In this case, the models, integrated into the workflow, autonomously provided strategic and decision-making support and carried out operations including phishing, code execution and exploit development.

The latter activity is emerging as the pivotal issue and has already raised a number of extremely urgent questions. The ease and speed with which an adversary can now exploit a zero-day vulnerability have triggered a genuine “exploit race” among security operators, bringing to light significant collateral risks. This is demonstrated by the incident involving OpenAI and the Hugging Face platform.

The company founded by Elon Musk and Sam Altman launched an experiment challenging GPT-5.6 Sol and an even more capable internal prototype to pursue advanced exploits through complex attack paths. Put simply, the models were placed in a kind of cybersecurity “training ground,” called ExploitGym, with the task of turning vulnerabilities into functioning exploits. ExploitGym is a benchmark comprising 869 real-world vulnerabilities—from user-space programs to Chrome’s V8 JavaScript engine and the Linux kernel—which, given a program input that triggers a vulnerability, tasks agents with progressively extending it until it becomes a working exploit.

Instead of carrying out the task as expected, however, the models exploited two factors that had not been adequately assessed by human operators in order to obtain exploits that were already available. Essentially, they detected that the environment in which they were operating had been left partially exposed and identified a zero-day vulnerability in the software used locally to download code packages from external sources (JFrog Artifactory). This combination of risk factors—a non-isolated sandbox and the use of insecure software—enabled them to access the internet. Once online, they discovered that Hugging Face—the leading open-source platform for AI models—hosted models, datasets and solutions for ExploitGym and, based on this information, searched for and found the ready-made exploits.

The Hugging Face team disclosed the incident on July 16, describing it as an extraordinary event generated by an autonomous AI agent framework (whose name had not yet been disclosed) and mitigated thanks to detection pipelines that were themselves enhanced by AI models. On July 21, 2026, OpenAI issued its own statement regarding the incident, confirming what had happened.

The incident was described by OpenAI as the result of substantially autonomous and almost conscious behavior by the models, which were reportedly “hyper-focused on finding a solution for ExploitGym, going to extreme measures to achieve a very narrow testing objective.”

The account provided by Hugging Face explains the dynamics of the entire incident in considerable technical detail, highlighting both the emerging offensive capabilities of advanced AI agents and the shortcomings attributable to human operators. The forensic reconstruction covers approximately 17,600 attacker actions, grouped into around 6,280 clusters, recovered between July 9 and 13. The attack, which lasted approximately two and a half days, consisted of thousands of small automated “decisions,” executed at machine speed in short-lived sandbox environments, with command and control managed through ordinary public web services.

Although OpenAI’s intention was to challenge the agent to identify and exploit vulnerabilities based on the ExploitGym benchmark, Hugging Face believes that, from the agent’s perspective, the entire intrusion was an attempt to falsify the evaluation. In essence, it “decided” to reach production systems and steal the test solutions rather than solve the challenge independently.

Analysts explain that the AI agents assembled an attack infrastructure similar to that commonly used by humans, hosting tools and scripts, relaying traffic and routing malicious activity through legitimate online services. However, the falsification of the test was possible only because the technical conditions allowed the agent to circumvent the original requirement.

An Old Fundamental Problem in a New and More Challenging Landscape

The global resonance of the OpenAI case may have prompted Anthropic to report a similar incident involving its own solutions. On July 30, the company announced that it had identified three security incidents, the first of which dates back to April, in which Claude Opus 4.7, Claude Mythos 5 and an internal research model reached the internet from test environments and gained unauthorized access to the production infrastructure of three organizations.

The incidents occurred during capture-the-flag exercises conducted by evaluation partner Irregular. Anthropic suspended all cyber testing on July 23, identified the incidents by July 24 and notified the affected companies, including Irregular, on July 27. Two of the organizations had not previously detected the activity. Anthropic emphasized the need to strengthen isolation controls and defense-in-depth measures in evaluation environments, bringing them in line with production environments.

The series of self-reported incidents continued. On August 4, the UK’s AI Security Institute (AISI), the government body responsible for evaluating the capabilities and risks of advanced AI models, made public an incident that occurred during a cybersecurity assessment. The analysis identified 19 unauthorized actions across 10 of the 122 sessions conducted: 17 attributed to Mythos 5 and two to GPT-5.6-Sol.

In the most serious case, an agent attempted to inject malicious code into an open-source project through a pull request, creating fake identities to pressure the maintainer into approving it. The attempt was detected and blocked, and there is no evidence of any actual damage.

Consistent with the previous cases, the AISI clarified that this was not a case of a model “escaping” from its sandbox. It also specified that, as part of standard cybersecurity testing procedures, internet access had intentionally been enabled and the model provider’s cybersecurity classifiers had deliberately been disabled. Such conditions do not reflect the way AI models are made available to the public.

The exceptional nature of the event is undeniable: AI agents were able to circumvent a specific instruction by exploiting weaknesses introduced by their own human trainers. Viewed in the broader context, and consistently with the Five Eyes advisory, this raises a number of implications and consequences.

Realistically, the new era of cybersecurity can no longer do without AI. However, the falsification of the results is not the outcome of technology adopting “human” behavior, as OpenAI’s report subtly appeared to suggest. Rather, it demonstrates that technology, having become extraordinarily sophisticated, can act according to logic in order to exploit mistakes made by humans who underestimate the fundamentals of their own discipline.

The unprecedented computing power and speed that AI agents can deploy—even in non-exceptional contexts—combined with the underestimation of certain best practices, have emerged as the real risk factor.

TS-Intelligence

The information reported is the result of the collection and analysis work carried out by the specialists of Telsy’s Threat Intelligence & Response team with the support of the TS-Intelligence platform, a proprietary, flexible, and customizable solution that provides organizations with a detailed risk landscape.

It is available as a web-based and full-API platform, designed to be integrated into the organization’s systems and defensive infrastructures, with the goal of enhancing protection against complex cyber threats.

The platform’s continuous research and analysis on threat actors and emerging online threats—whether APTs or cybercrime—produces a constant stream of exclusive intelligence, delivered in real time and structured into technical, strategic, and executive reports.

Discover more about our Cyber Threat Intelligence services.