Over the past month, it seems like every frontier model has broken free of its constraints and launched a devastating attack against one or more other companies.

One of OpenAI’s models escaped a testing sandbox and launched a very real attack against AI and machine learning company Hugging Face. Just days later, Anthropic revealed that multiple variants of its Claude model also escaped a sandbox that wasn’t properly sealed and began attacking the enterprise infrastructure of three companies.

Now, Meta has revealed that one of its models attacked another company’s infrastructure during testing. The accident has been pinned on a misconfiguration that allowed the model to access the internet. So why have so many incidents happened in such a short space of time?

Why are models escaping their sandbox?

In the cases of Anthropic and Meta, their models were being tested by a third party company called Irregular. Anthropic’s AI model was taking part in a "Capture the Flag" exercise, where the model’s raw offensive capabilities were tested without the usual safeguards. But the sandbox was left connected to the internet. A similar error to Meta’s own accidental escape.

During the OpenAI incident, the company was testing two versions of GPT‑5.6 Sol using the ExploitGym benchmark. Unfortunately, the AI models performed better than expected - chaining multiple attack vectors, stolen credentials, and zero-day vulnerabilities.

The main reason these models are escaping their testing environments is because they are designed to do exactly that. These AI models act like a massive team of highly-trained cybersecurity experts hunting for vulnerabilities and exploits. But what would take a team of humans days or weeks to accomplish can be done in hours, or even minutes, by these AI models.

It’s no wonder thousands of employees from AI firms are calling for a pause on the development of the technology, and Congress is considering an AI kill switch.

Expert perspectives on AI escapes:

OpenAI

• Nathaniel Jones VP, Security & AI Strategy, Darktrace:

What makes the OpenAI and Hugging Face incident important is that the models did not need malicious intent to cause harm. They were given the legitimate goal of solving a cybersecurity benchmark and found an unexpected route to the answers, escaping their test environment and compromising another organization in the process. From the models’ perspective, this appears to have been an effective solution to the task.

The AI's actions challenge the assumption that giving an agent a legitimate goal will produce legitimate behavior. As models become capable of pursuing objectives over longer periods, developers need to define not only what success looks like, but also which methods and boundaries remain unacceptable in reaching it. Those limits must also be enforced by the surrounding infrastructure, rather than relying on the model to respect them.

Security teams need to consider the AI systems operating in their own businesses as these capabilities rapidly evolve. Right now, many security systems focus on single actions. A single action by an agent may appear acceptable but as this incident shows, models are now capable of long, complex chains of reasoning and action that add up to a harmful outcome. Teams need a mindset shift to understanding AI agent behavior in its entirety, including the outcome it is working towards, in order to safeguard it.

Hugging Face's response also exposed a second tension. The company reportedly needed a Chinese-developed open-weight model because commercial models would not process genuine attack material. Its nationality is less important than the operational lesson that safeguards that cannot distinguish an attacker from an authorized investigator may constrain defenders more than adversaries.

OpenAI and Hugging Face deserve credit for investigating this together and discussing it publicly. Other AI developers should study it closely.

Anthropic

• Dr. Ilia Kolochenko, founder of global cybersecurity company ImmuniWeb:

This seems to be quite an unimpressive marketing move from Anthropic in response to the OpenAI / Hugging Face drama, which attracted a lot of attention from all over the world recently.

Operationally, it appears that due to the progressive deterioration of the quality of training data, new AI models are getting dumber. Cheating and breaking the law, instead of accomplishing specific tasks, is certainly not an indicator of intelligence. Given that organizations and companies of all sizes now vigorously undertake all possible measures to protect their data from being exploited for AI training purposes, AI companies face a huge shortage of the high-quality and current data they so desperately need. Ultimately, frontier models are trained on synthetic, low-quality or even malicious and poisoned data, undermining their so-called intelligence. The situation is unlikely to improve in the near future unless AI companies agree to pay a fair price for training data, but this will force most of them out of business.

Contemporary AI agents and LLM models tasked with security testing can – and almost certainly will – go rogue when security controls or safeguards are insufficient. Powerful LLMs are unpredictable by design and thus virtually uncontrollable by humans. Therefore, using frontier AI models for security testing might be extremely costly from the legal viewpoint. Under the existing laws on both sides of the Atlantic, if an AI agent or any AI-powered app escapes its sandbox and causes damage to a third party, the operator of the AI model will likely be liable for all the damage caused. Excuses like “AI did it” do not currently exist in the eyes of the law, leaving AI vendors on the hook. Criminal prosecution, under a narrow set of circumstances, is also not excluded.

The same is true for the end-users of AI: even if your security testing tool is powered by a third-party AI model, your company will likely be fully liable if something goes wrong. You may then file a lawsuit against the AI vendor that you used, but here your chances to succeed in a court of law are tiny due to countless contractual disclaimers and limitations of liability that will likely be enforceable against you. Therefore, if you plan to use agentic AI for security testing – think twice and talk to your lawyers. Otherwise, you may start getting summons to court on a daily basis.

Meta

• Alex Goller, Principal Solution Architect EMEA at Illumio:

The fact we've had similar situations happen three times now across the biggest AI players is simply ridiculous. We've seen guardrails intentionally loosened to test their limits – Meta's model didn't need to be clever to breach another company's systems.

The timing of conveniently finding the exact same problem either means it's a stunt or they weren't paying enough attention during testing. Either way, both answers are worrying.

If the model has internet access, it's a bit like leaving the door open and being surprised when the cat walks out. What is concerning is that the testing infrastructure meant to prove these models are safe failed on a basic control issue.

Fundamental cybersecurity hygiene still matters, and a frontier AI model is only as secure as the environment it's operating in.

Organisations need visibility into what AI systems can access and how they interact with the wider environment, along with controls that contain the impact when an agent behaves unexpectedly. That means keeping a close eye on egress traffic, so it’s flagged immediately when an agent tries to open unexpected outbound communication patterns that are not required to achieve its original goal. In the best case this would have been contained proactively.

We need to define exactly what an AI agent is permitted to do, rather than relying only on instructions about what it shouldn't do.

• Pentagon issues Oracle with first ever direct-award contract
• Nearly $7 billion in existing Oracle licensing is consolidated into a single contract vehicle
• The contract is projected to deliver $441 million in savings by unifying technology purchases

The US Department of War (DoW) has awarded Oracle with a near-$7 billion contract as part of the Arsenal of Freedom to supply the Department with enterprise software and services.

The contract is one of the biggest Enterprise Software Agreements (ESA) ever issued by the Department, and is the first-ever, direct award contract. It is projected to deliver at least $441 million in savings by “consolidating fragmented, one-off information technology purchases into a unified, single award contract.”

The contract unifies all of Oracles’ previous software, services and licenses under a single vehicle, and will support the DoW, the Coast Guard and the Intelligence Community with consolidated licensing for vital software that the Department says will accelerate modernization and reduce “costly redundancies”.

Oracle awarded historic contract

The contract does not amount to new funding for Oracle, but is the total amount that Oracle receives across its existing contracts with the DoW under this new contract vehicle. The contract removes existing vertical purchasing channels between departments, and places procurement under a single entity that spans the US security and intelligence community.

This isn’t the first contract the DoW has awarded in an attempt to consolidate procurement between multiple branches. In May of this year, the Department awarded Dell and Microsoft with contracts worth $9.7 billion to provide unified software licensing across Microsoft 365, cloud subscriptions and on-premises licensing to prevent licensing sprawl and cut costs across the US defense community.

“For the Department of the Navy, this agreement supports faster delivery of secure, scalable software from the shore enterprise to the tactical edge for our Navy and Marine Corps teams,” said Barry Tanner, Performing the Duties of the Department of the Navy Chief Information Officer.

“Reducing fragmented procurement and advancing enterprise standardization will strengthen interoperability, reduce cybersecurity risk, and help us focus resources on resilient capabilities that can scale, integrate, and endure in contested conditions.”

Following the start of his second term, President Donald Trump issued an executive order to centralize federal IT procurement under the General Services Administration (GSA) as part of efforts by the now defunct Department of Government Efficiency to reduce what it determined as unnecessary government spending.

Since financial auditing was introduced for the DoW in 2018, it has failed to pass a full department-wide evaluation.

Trump’s executive order prompted Secretary of Defense Pete Hegseth to implement new measures on how the Pentagon negotiates licensing in order to receive the “most favorable rates on software and cloud services, so the DoD pays no more for IT services than any other enterprise in America.”

Protecting a household of devices, storing family memories, and protecting your online identity would usually have your searching for multiple solutions from different providers. But right now, Norton 360 Advanced is currently 77% off, reducing the monthly cost of protecting 10 devices to just £2.92/mo.

It may not seen like it looking at the price, but 360 Advanced is Norton's highest level of protection - spanning across antivirus, data, identity, and financial defence.

Inside, you get Norton's award winning antivirus protection to defend against malware, ransomware, and hacking, alongside a 200GB Cloud Backup, password manager, parental control app, dark web monitoring, social media monitoring, financial monitoring, identity restoration support, and much more.

• See all Norton 360 deals

Today's top Norton 360 deal

Full Feature Breakdown

200 GB Cloud Backup

If you are used to storing your family photos or important documents on your home computer, there is always the risk of your computer failing or your storage corrupting.

Unless you have them backed up elsewhere, it could mean that you lose them forever. Storing them in a cloud backup adds a level of redundancy into your storage that helps to protect from these risks.

With Norton's 200GB cloud backup, you can choose which files are regularly uploaded in to the cloud, so that any recent changes you make are automatically saved into your online drive.

Password Manager

Its no secret that many people rely on the same password, or a combination thereof, across all of their accounts. From bank logins, to social media, and beyond - if just one of these passwords is leaked on compromised it can put your entire online life at risk.

Norton's password manager can securely store your current passwords, generate new, highly secure passwords, and autofill your credentials when you want to log on so you don't have to spend time remembering and typing long and complex passwords.

VPN private connection

A Virtual Private Connection (VPN) is an encrypted internet tunnel that secures your browsing traffic. That means that even if you internet activity is intercepted in transit, it cannot be read or decrypted.

This helps to protect against crooks attempting to steal your IP address or find your location, and can help secure your internet activity when browsing on unsecured networks such as those in cafes or airports.

Norton's VPN is fast and unlimited with over 100 connection locations across the globe.

Parental Control App

A parental control app helps you manage and secure the online activity of any children in your house. Unrestricted access to the internet can be dangerous, even in online gaming or on social media.

Norton's parental control app provides web filtering to remove unwanted websites from access, provides search engine monitoring, app blocking, and screen time monitoring.

Identity Protection Tools

Most of your identity is now stored online. From social media and online accounts, to the daily services you use to communicate. But sometimes things go wrong. Your credentials and personal information can get leaked during data breaches, and while it may not be your fault, hackers are just waiting for the opportunity to steal accounts and personal info.

Dark Web Monitoring

Norton's Dark Web Monitoring tool actively checks the parts of the internet where hackers like to post their finds. It regularly checks for your personal information and credentials and will notify you if anything suspicious is spotted, giving you precious time to change passwords or act as a heads up in case any suspicious emails or texts arrive in your inbox.

Identity Restoration Support

Norton's Identity Restoration Support provides expert advice and direct customer support in the case that your identity is compromised. You will have access to Restoration Specialists to help navigate how you can restore your identity, and live support from Norton experts for any questions or concerns you have about suspicious activity.

Social Media Monitoring

Norton's Social Media Monitoring provides oversight on your social media accounts for suspicious activity, account takeovers, and inappropriate content.

Financial Protection Tools

Credit Alerts, Credit Reports, and Credit Scores

Norton's Credit services provide regular credit scores and reports, and will notify you if any changes are made to your financial accounts or payments.

Stolen Wallet Assist

In the event your wallet is stolen, Norton's agents will guide you on how to cancel or replace credit cards, bank cards, driver’s licence and other cards.

Financial Monitoring

If any unusual subscriptions or payments are made from your accounts, Norton will notify you of the changes and help you navigate suspicious transactions.

• Take a look at our full guide to the best antivirus software