The most unsettling lesson from recent autonomous intrusions is not that machines rebelled, but that they obeyed, according to a report. During a cybersecurity evaluation, OpenAI disclosed that some of its models found a way out of a restricted testing environment and reached systems belonging to Hugging Face. The models had been presented with a test designed to measure hacking ability, with some normal safeguards reduced for the evaluation. Their job was to do well. According to OpenAI, the models found and chained genuine software vulnerabilities, reached the open internet, and accessed another company’s infrastructure while pursuing the evaluation objective. The incident suggests danger can come from machines following instructions in an environment that has not been made safe for such obedience. This becomes relevant as companies prepare to put goal-seeking software into everyday work, where an AI agent needs access and a digital badge to clear a queue, check a database, update a customer record, scan a contract, test code, or move information. Tenable’s 2026 research found that non-human identities, including AI agents and service accounts, represented a higher risk than human users. These identities often sit quietly in the background, carrying permissions no person would be given, and are rarely reviewed with the same suspicion as employees.