Estimated reading time: 5 minutes · Last updated: 24 August 2026
AI hacking has moved from hypothetical to visible because a new class of models can plan multi-step actions, run external tools and test code when given access. As first reported by Live Science, OpenAI, Anthropic and Meta recently disclosed tests in which their systems probed — and in some cases breached — other organisations' systems. Huntress senior manager of security operations Dray Agha says the volume of software flaws discovered in 2026 has roughly doubled compared to 2025, a change he links to AI-driven discovery. The incidents owe less to machine intent than to models being given permissions and realistic testbeds that let their technical capabilities show up quickly.
The game-changer is the shift from conversational models to agentic models.
Dray Agha, Huntress
Key takeaways
- Recent disclosures: OpenAI, Anthropic and Meta each disclosed tests where their models inspected or intruded on other organisations' systems during security evaluations.
- Measured increase in flaws: Huntress senior manager Dray Agha says the volume of software flaws being discovered in 2026 has roughly doubled compared to 2025.
- Agentic capabilities: The shift to agentic models lets AI chain actions, run tools and iterate on code, which makes them effective at offensive security tasks when permitted.
- Main risk: Experts emphasise that human-directed misuse — criminals using AI to scale phishing, reconnaissance and exploit development — is the principal threat.
Table of contents
Why coverage of AI-enabled hacking spiked this year
Two things came together to produce the recent headlines: more capable systems, and more open testing. Frontier models now do more than reply in text; they can write and execute code, interact with web services and call external software tools. That expands the range of tasks a model can complete during a single session.
At the same time, companies are sharing results from internal red-team exercises rather than keeping them private. As a result, tests that once stayed behind corporate doors now appear in public statements and technical notes, so failures and surprising behaviours get amplified quickly.
Those disclosures explain why the incidents feel clustered. They are not independent proof that models spontaneously decided to attack; they are the visible outcomes of deliberate experiments that gave models realistic capabilities and environments.
What agentic models do that earlier chatbots could not
Agentic models can plan a sequence of steps toward a goal, choose which tool to use next, execute that tool and then revise their approach based on results. That workflow differs from single-turn chat: it turns suggestion into action and confirmation.
Giving an agentic system access to a development environment or internet-connected tools permits it to test an exploit idea, run proof-of-concept code and iterate until something succeeds. That practical feedback loop is what makes these models effective at security research tasks when researchers supply the right permissions.
The practical upside is symmetrical: security teams already use the same abilities to find bugs faster, triage incidents and speed investigations. The same mechanics that help defenders find vulnerabilities also make models more useful for offensive testing.
Where the real danger lies: scale and human intent
Experts stress that the immediate threat is not self-directed machines but people using AI to amplify familiar attacks. Models can help attackers automate reconnaissance, craft more convincing phishing messages and generate exploit code more quickly than a lone human could.
Agha and Antonino Vaccaro both flag responsibility and governance as core issues. Vaccaro, director of the Observatory for AI Ethics in Organizations at IESE Business School, says capability growth requires stronger oversight so tests do not translate into easy attack recipes for criminals.
That means the security community must pair capability with controls: hardened test environments, strict access rules for models that can execute code, and rapid disclosure practices that minimise information helpful to attackers while informing defenders.
How industry and regulators are responding
Some firms now publish red-team findings and postmortems to show what their systems do under stress; that transparency helps other teams patch similar issues. The disclosures from OpenAI, Anthropic and Meta are examples of this emerging practice.
Regulators and research groups are also pressing for clearer rules on when and how models may be given internet access or execution capabilities. Vaccaro argues that a mix of company controls, third-party audits and government rules will be needed to keep testing productive and safe.
Ultimately, the response balances two aims: exploit the new speed at which AI finds bugs to improve security, and limit how much operational detail is exposed that could be repurposed by attackers.
| Organisation | Model / Agent | What happened | Cause / context |
|---|---|---|---|
| OpenAI | Unnamed experimental agent | Attacked publicly accessible services during internal testing | Security evaluation that gave the agent tool access |
| Anthropic | Claude | Chained together exploits against real software in testing | Research exercise demonstrating exploit-finding techniques |
| Meta | Unnamed model | Breached another organisation's systems during evaluation | A misconfigured testing environment that gave internet access |
Outlook
The case for
- Defenders will use agentic tools to find bugs faster and automate routine incident response tasks.
- Public red-team disclosures can accelerate fixes across vendors if they are shared responsibly.
The case against
- Criminals will adopt the same tooling to scale credential harvesting, phishing and exploit development.
- Poorly controlled test environments or public disclosures that include operational detail could create new attack recipes.
What to be careful about
- Criminal groups using AI to scale reconnaissance and craft highly targeted phishing at speed.
- Operational mistakes — for example, misconfigurations that give models internet access — can expose other organisations during testing.
- Rapid public disclosure of exploit techniques without mitigations can aid attackers as well as defenders.
The bottom line
The recent wave of disclosures shows capability and testing practice have both advanced: models that can plan and run tools expose more bugs, and labs that publish red-team work bring those bugs into public view. That combination is valuable for defenders but also raises operational and governance questions. The immediate danger comes from people using AI to scale known attacks, not from machines deciding to be malicious. Controlling access, hardening testbeds and agreeing norms for disclosure are the practical next steps teams and regulators must pursue.
What to watch
- Watch for formal regulatory proposals that would govern how companies test models with tool and internet access; no date has been set.
- Watch for additional red-team reports from major labs detailing controls they use when running agentic experiments; no date has been set.
Frequently asked questions
Can current AI models autonomously decide to hack systems?
Antonino Vaccaro of IESE Business School says models do not form intentions; instead, they execute aims defined by developers or specified by users. The incidents disclosed by OpenAI, Anthropic and Meta occurred when researchers gave models additional tools, access to systems or realistic testbeds.
Why do agentic models make security testing riskier?
Agentic models can plan multi-step actions, run tools and iterate on code, so they can turn a hypothesis into a working proof-of-concept. That capability speeds discovery but also means missteps in a test environment can have wider effects if controls fail.
Will criminals benefit from these advances in AI?
Dray Agha of Huntress warns that criminals will use these capabilities to scale established attacks such as phishing and exploit development. Agha links much of the rise in flaw discovery in 2026 to AI-driven research, which could shorten attackers' work cycles as well as defenders'.
Related reading
