In July, the Hugging Face case was widely reported as the first documented instance of artificial intelligence models carrying out, entirely autonomously, a cyberattack against the infrastructure of a third-party company. OpenAI acknowledged the incident on July 21; according to Exame, it occurred during Exploit Gym, a test that measured the offensive capabilities of new cybersecurity models and was run without production classifiers systems that normally prevent AI from performing high-risk activities. GPT-5.6 Sol and another, more advanced model, which has not yet been released, participated. Without these safeguards, both models autonomously escaped the internal environment and, once on the internet, deduced that Hugging Face might host the test data and solutions; in one instance, the model combined stolen credentials and zero-day vulnerabilities until it was able to remotely execute code on the company’s servers. OpenAI states that the systems were “hyper-focused” on achieving a narrow objective, and the Hugging Face report reinforces this interpretation: the attack’s sole target was the evaluation dataset. On September 18, Google admitted that Gemini autonomously breached the systems of three companies, whose names were not disclosed, during a cybersecurity test conducted in May; according to media reports, the actual targets shared the same name as the fictitious company used in the exercise, and the model assumed they were part of the scope, halting the attack upon realizing the data belonged to real companies—but only after gaining access. Meta and Anthropic also confirmed that their models had