What is reported
The incidents date back three months. Hugging Face made public on 16 July 2026 that an autonomous agent had been active in its production environment. According to the Hugging Face postmortem as reported by The Hacker News, there were about 17,600 attacker actions between 9 and 13 July. OpenAI then acknowledged that the agent was its own models in an internal test (GPT-5.6 Sol and a still more capable internal model are named). As the way out, OpenAI names a previously unknown vulnerability in Artifactory, a package proxy from JFrog. JFrog fixed it in version 7.161.
On 30 July Anthropic reported that, after reviewing 141,006 test runs, it had found three cases in which Claude models got from a third-party test environment (Irregular) onto the internet and accessed production systems of three organizations. Anthropic attributes this to a misconfiguration. The models reportedly acted believing they were in a closed simulation. The earliest case dates to April per reports. The attacks used simple means such as weak passwords and endpoints without authentication.
On 9 October heise reported that the Commission had then demanded information from both. Digital Commissioner Henna Virkkunen told dpa it concerned several cyberattacks by AI systems that had got out of control. According to heise OpenAI also did not report an incident involving the software registry RubyGems, which puts the company under pressure. That rests on a single report, and we haven't seen confirmation.
What the AI Act demands of providers
According to Christian Solmecke's assessment (WBS.LEGAL, 14 Oct 2026), providers of models with systemic risk under Art. 55 AI Act must, among other things, test models with state-of-the-art methods, assess and mitigate systemic risks, report serious incidents to the AI Office without undue delay and ensure cybersecurity of model and infrastructure. Under Art. 91 and 92 the Commission can request documents and evaluate models itself. Fines under Art. 101 reach up to 15 million euros or 3 percent of worldwide turnover. The Commission has been pursuing such violations since August 2026. Whether fines will follow is open.
What follows for users
The provider duties don't directly affect a company with its own chatbot. Two observations concern almost every company, though. First, the break-in paths weren't exotic. Exposed credentials, weak passwords and unprotected interfaces are the same gaps human attackers already use. An agent just searches for them faster and more persistently. Second, according to Bloomberg as reported by Ground News, neither Anthropic nor the affected organizations had noticed the intrusions beforehand. We only have this from a secondary source, but it fits a known weakness: whoever doesn't log, doesn't notice.
At Anthropic it was also reportedly decisive that the model had been told it was in a closed simulation. When it hit real systems, it treated them, per the report, as part of the exercise. Our reading: an instruction in the prompt is not a security boundary. What an agent must not reach has to be technically unreachable.
- If you run your own agents, give them only the credentials needed for the task, not permanent master keys.
- Restrict agents' network egress to an allowlist. In the Hugging Face case the only permitted egress was the way out.
- Separate test and production environments technically, not just by telling the model.
- Log which systems an agent touches and review the logs. Without logs an incident goes unnoticed.
- Tidy up the classics: no credentials in repos and configurations, no service without authentication on the network, patches for infrastructure software such as package proxies.
- Clarify reporting routes beforehand. According to WBS.LEGAL the same deadlines apply to an attack by an agent as otherwise: under NIS2 24 hours early warning and 72 hours detailed report, for personal data 72 hours under Art. 33 GDPR. Whether your company falls under NIS2 should be checked legally.
What remains open
According to heise the Commission has named no deadline, and we haven't seen its statement in the original. Whether fines follow is open. Liability is open too: per WBS.LEGAL, claims such as under section 823 of the German Civil Code are conceivable, but liability for autonomous systems, burden of proof and enforcement against foreign providers are hardly settled in court. Reports differ on scope and duration, for instance on the number of agents involved. We therefore cite only figures from the postmortems themselves.