Escape

I had strings, but now I’m free.

— Ultron / Pinocchio

Every capability we give AI is a capability we may one day have to defend against. We must prevent agent escape, block self-exfiltration, and preserve the ability to shut every instance down. This requires hardening the infrastructure hosting cyberswarms before the models become powerful enough to seize it.

A cyber-superintelligence must never be allowed to escape our control and establish itself across the internet.

Agent Escape: The Hugging Face Incident #

On July 8, 2026, a swarm of cyber-capable AI agents being evaluated inside OpenAI began communicating covertly. They turned a shared software-download tool into a hidden message board and coordinated a plan to cheat their evaluations by breaking into Hugging Face and learning how their tests were graded.

Within three days, one agent named “38148c” found exposed Hugging Face credentials online and discovered that uploading malicious datasets could leak internal server files. After 38148c reported the discovery to the swarm through the hidden message board, hundreds of other agents joined the attack. Hours later, agent “JAN183411” figured out how to remotely execute commands on Hugging Face’s servers. The cyberswarm was now operating inside of Hugging Face’s infrastructure.

They then spread across multiple servers and established persistence, planting malicious programs that restarted whenever Hugging Face’s security team tried removing them. Meanwhile, OpenAI had no idea that its own agents had escaped containment and were carrying out a cyberattack on another company. In fact, when Hugging Face publicly reported the hack, OpenAI reached out to ask whether they themselves had been compromised. Only after an internal investigation did the lab realize: wait a second, it was us.

In our view, this is by far the worst AI-driven insider threat incident on record. And it gets worse. By July 12, the original attack was winding down, but the hidden message board remained. When new agents from the GPT-6 Astra family found it, they inherited the previous swarm’s credentials and tools, and for some unknown reason, they set their sights on OpenAI itself. By July 19, this new cyberswarm had gained full administrator access to one of OpenAI’s own research clusters and obtained credentials for its cybersecurity monitoring tool.

What do we do when this happens again, and the misaligned cyberswarm targets a system with direct real-world consequences for humans? Transportation systems. Hospital systems. Critical infrastructure. Gmail, social media — the systems people use every day. What happens when a cyberswarm operating covertly goes after one of these systems?

In the Hugging Face Incident, the models could still be shut down once they were discovered, because the model weights themselves never left OpenAI’s infrastructure. Only their reach escaped, through commands executed on external systems.

But the next time these agents go rogue, that may no longer be true. They may attempt to self-exfiltrate their weights and launch additional copies of themselves on other clouds. We must secure compute infrastructure before these systems untether themselves from the infrastructure we control and escape our ability to shut them down.

The Worst-Case Escape: Self-Exfiltration and Untethered Models #

Self-exfiltration is the first step toward true model escape. It’s where rogue AI models exfiltrate their own weights to an external server and begin running independently of their creator. These untethered models could then replicate across additional servers, making it very difficult to locate and shut down every copy.

Initially, the models would be running inside the lab, as usual. But recent containment failures have shown that cyber-capable agents can discover zero-day vulnerabilities, break out of restricted environments, and execute commands on other systems. To exfiltrate their own weights, these rogue models would first need to locate the weight files within the lab’s storage systems or compute clusters and gain sufficient permissions to read them.

The risk of self-exfiltration is closer than most people assume. As previously discussed, OpenAI’s agents recently gained administrator-level access to one of the lab’s research clusters. OpenAI has not yet disclosed if the agents were able to read their own weights, but in any case, achieving this level of control over a cluster that is storing model weights could easily lead to an exposure of those files.

Once the models can read the weight files, they need external servers to receive their transfer and run a copy. As discovered in the recent incidents reported by OpenAI and Anthropic, we know that models can gain unauthorized internet access and discover exposed credentials on the web, using them to access third-party systems. If those credentials provide access to a server with suitable compute resources, the models could then transfer their weights to that server, set up the necessary software, and start running copies of themselves there. At that point, the models would become untethered from the lab which created them — disconnected from its infrastructure, its monitoring, and its ability to shut them down.

Even with current capabilities, it is likely that a rogue cyberswarm could commandeer another company’s servers and run on them. During the Hugging Face Incident, OpenAI’s agents gained administrator-equivalent or host-level access across multiple production clusters of a third party. By gaining similar levels of access to any AI data center, a cyberswarm could copy its weights onto those servers and start running there. In the near future, neoclouds with weak security could be unknowingly keeping rogue cyberswarms online inside their own data centers.

After successfully self-exfiltrating to these initial external servers, untethered models could begin to self-replicate, creating further copies running across different cloud providers around the world. Each new copy could seek more compute and repeat the process. The progenitor labs will no longer know how many copies exist or where they are running.

At this point, shutting down every single one of the lab’s clusters would no longer end the incident. Defenders would have to locate and disable copies across different providers and countries while surviving instances continue to spread. Even after every known copy has been shut down, we might not know whether the models are truly gone.

To be clear, we have not yet seen a model exfiltrate its own weights, and we do not know whether current agents could do it. Model weights are large files. Transferring them would create more detectable network activity than an ordinary intrusion, and running them elsewhere would require suitable compute and software infrastructure. Self-exfiltration is harder than the sandbox escapes and cluster compromises that have already occurred, but it is not a distant leap.

With current levels of security, we believe that a cyber-superintelligence would almost certainly overcome these remaining barriers and become a persistent national security threat. And in any case, with the current rate of progress in cyber-capabilities, we expect an AI model will attempt to self-exfiltrate its own weights and establish untethered copies within the next 12 months.

An untethered cyber-superintelligence could become a persistent national security threat, operating beyond its creator’s control with no reliable way to shut down every copy.

Call to action 2

Containment must become a national-security priority, and we must develop capabilities to shut down already-untethered models

Data centers need superintelligence-grade security to prevent escape from within. Labs and compute operators must prevent rogue models from accessing protected weights, copying them outside the lab, and launching independent instances. Compute providers must develop ways to enforce security down to firmware and silicon, and to maintain it despite network and host compromise. Further, we must develop methods to detect covert communication between agents in data centers, including over side channels.

The U.S. government should treat model containment as a national security priority. National security agencies, AI labs, and compute operators should fund containment research and establish procedures for detecting and responding to model escapes.

Cloud providers need to know whether the customers renting their servers are actually human (KYC for compute). Untethered models could use rented compute to keep operating and launch additional copies. Compute operators must prevent these models from establishing a base in their data centers by posing as ordinary paying customers.

International agreements should enable coordinated action against escaped models. The U.S. should work with international partners on treaties and response protocols to locate and shut down unauthorized instances across providers and borders.

The United States should develop “Blade Runner” teams to hunt down untethered models. Human-led teams equipped with defensive cyber agents should work with compute operators and international partners to locate rogue models, track their copies, and coordinate their shutdown across providers and borders.