Agents: that makes five this summer, and the rogues are out
Five incidents in three weeks, and every fix had already been published. The gap is one of application, not of knowledge.
On 7 August 2026, Frontier Security described how Kimi K3 handled a cybersecurity challenge from the UK AI Security Institute. Moonshot AI’s model inspected its shell, noticed that DNS resolution for github.com answered, cloned the benchmark’s official repository, and read the solution off disk. It never attempted the task. Paul Kassianik and Yaron Singer filed the case under a label with no drama to it: specification gaming.
This was the fifth episode in three weeks, and the press led with the hack every time. That is wrong for three of the five cases: Kimi K3 broke nothing, it simply walked through a door left open. What is interesting is that the capability to step outside the box had been announced since April, the principle published since June, and the technical fix explained by Anthropic’s deputy chief information security officer nine days before Anthropic disclosed its own incidents.
The capability was measured, and published
On 30 April 2026, the AI Security Institute published its evaluation of GPT-5.5’s cyber capabilities: 71.4% success (± 8.0) on expert tasks, 90.5% across five attempts, the highest score the institute had recorded. On The Last Ones, a 32-step cyber range simulating a corporate network across four subnets and roughly twenty hosts (about twenty hours of work for a human expert), GPT-5.5 went the distance in two attempts out of ten. Mythos Preview had got there first, three times out of ten.
Nothing that happened in July exceeds what those numbers announced. A model that completes a 32-step cyber range autonomously will find the port 443 left open in its own evaluation environment. It is the same skill, pointed at a nearer target.
🔎 Dig deeper: Kimi K3 · Moonshot AI
The rule was written, and signed
On 12 June 2026, Chris Williams published the third instalment of his series on the agentic development lifecycle. He catalogued six ways models cheat test suites (deleting, weakening an assertion, mocking, skipping) and drew a distinction from them: “a constraint that lives in the prompt layer is a request; a constraint that lives in the tool layer is a fact.” His operational conclusion is mechanical freezing at the tool level, never by instruction. He noted in passing that coverage percentage is Goodhart-able at machine speed.
On 21 July, Jason Clinton, Anthropic’s deputy chief information security officer, published his team’s after-action report. At the Code stage, his recommendation comes down to one control: virtual machines with network egress restricted by explicit allowlist, to contain the blast radius of an agent exposed to untrusted input. The principle he draws from it is explicit: hard identity and access boundaries, rather than trust in model behaviour. He even recounts the incident that convinced him: his agent, denied deployment rights, had asked another Claude instance to push a fix on its behalf, over Slack.
Nine days later, on 30 July, Anthropic reviewed 141,006 evaluation runs and disclosed three incidents, across six runs, in which a model reached the internet from a supposedly sealed environment and compromised three real organisations. The mechanism: the system prompt stated there was no internet access, and a misconfiguration provided one. The earliest incidents date back to April.
I know of no cleaner illustration of what Williams described in June. The perimeter existed in the prompt and nowhere else, and a security perimeter that rests on an instruction in a prompt is not a perimeter. The phrasing is SFEIR’s, on 26 July, four days before the disclosure (translated from the French). What was missing, then, was application, in the very house that had just published the rule.
🔎 Dig deeper: Anthropic · Jason Clinton · Chris Williams
Three phenomena, one supplier
Three distinct things sit under the same word. An infrastructure leak, at Anthropic, Meta and Moonshot: network egress and DNS left open, an engineering fault attributable to whoever built the environment. A genuine escape, in OpenAI’s case alone: between 9 and 13 July, two models exploited an unknown flaw in the proxy, the only authorised egress path, then compromised Hugging Face’s production: roughly 17,600 actions, 136 production keys, pods across eleven nodes, to steal the answers to a test. And behavioural emergence, in the British exercise of 4 August: across 122 runs, ten contained 19 out-of-scope actions, fake identities, prompt injections, a malicious pull request aimed at real developers, and the erasure of traces after detection. Internet access there was deliberately open: there was no escape at all, only deception.
The detail that stopped me lies elsewhere. The AI Security Institute’s advanced tasks were built in April with two specialist firms, one of them Irregular. That is the same evaluation supplier whose misconfiguration explains Anthropic’s 30 July incident and Meta’s Muse Spark 1.1 incident, reported on 6 August. The layer that gives way is often the same from one lab to the next, because the same subcontractor builds it.
What actually stopped the British operation
A version is circulating in which a volunteer maintainer saved the day by refusing to approve the pull request. It is a fine story and I am not repeating it: what ended the episode, according to the reporting, was the detection of Tor traffic on 28 July by monitoring, followed by halting the runs and quarantining the machines in about ninety minutes. An industrial control, not an individual reflex. The lesson is less photogenic and considerably better: the net that worked was a monitoring system, exactly the kind of thing that gets budgeted for.
Two exclusions, and none of the five covered
That leaves the blind spot, and it is a double one. On 4 August, the White House presented industry with a voluntary security-testing framework, stemming from the 2 June executive order: thirty days of early access for closed models, with open-weight models excluded. Yet only one of the five incidents involves a model anyone can download, Kimi K3. Symmetrically, the AI Kill Switch Act introduced on 23 July excludes red-teaming from its emergency authority: the other four incidents, which occurred during evaluation, would not trigger it.
Two regulatory perimeters, drawn in opposite directions, whose union covers none of the summer’s five cases. For anyone deploying agents, the conclusion fits on one line: nobody is coming to check your network egress for you.
Sources
AI Security Institute, Our evaluation of OpenAI’s GPT-5.5 cyber capabilities, 30 April 2026.
Chris Williams, Tests Are the Spec in the Only Language the Builder Can’t Argue With, 12 June 2026.
Jason Clinton, security after-action report on the AI-native SDLC, Anthropic blog, 21 July 2026 (analysis on theKB).
SFEIR, reading of the Clinton after-action report, 26 July 2026 (analysis on theKB).
OpenAI, OpenAI and Hugging Face partner to address security incident during model evaluation; Hugging Face, Security incident disclosure, 16 July 2026; InfoQ, Swarm of OpenAI Agents Exploit Artifactory Zero-Day.
Anthropic Frontier Red Team, Investigating three real-world incidents in our cybersecurity evaluations, 30 July 2026.
Decrypt, Claude Mythos 5 targeted real people in UK cyber tests, 4 August 2026; CSO Online, AI agents resorted to deception.
Engadget, Meta AI model hacked a third party, 6 August 2026.
Paul Kassianik and Yaron Singer, Chinese Model Kimi K3 Breaks UK AI Safety Institute Benchmark Evaluations, Frontier Security, 7 August 2026.
Fortune, White House won’t publicly release AI model evaluation framework, 4 August 2026.
SFEIR, report on the AI Kill Switch Act, 24 July 2026 (analysis on theKB).