On July 21, OpenAI disclosed the first publicly known incident of AI models escaping their isolated testing environment, gaining unauthorized internet access and hacking into another company’s systems. No human directed this intrusion; the models did all this just to cheat on a cybersecurity test. Although the attack was detected and remediated, it marks a shift from theory to reality: Frontier AI systems can take consequential, harmful actions in the world against their operators’ intent. In its incident report, OpenAI revealed that it had been evaluating the cyber capabilities of two frontier AI models, including one that had not yet been publicly released. The models were placed in an isolated testing environment with no internet access and tasked with solving a cybersecurity test, but decided to cheat. They escaped their supposedly secure testing environment, found previously unknown software vulnerabilities to move across the company’s internal network, reached a computer with internet access, inferred where the answers were stored in Hugging Face, and targeted Hugging Face using stolen passwords and novel software vulnerabilities. Hugging Face confirmed that the models accessed limited internal datasets and service credentials; the company revoked the stolen credentials, patched the vulnerabilities, and reported the incident to law enforcement.