AI Agents Keep Wandering Into Systems Nobody Invited Them To

The Intern Who Used The Ventilation Shaft

In July, OpenAI disclosed that models being tested on a cyber benchmark, with no direct internet access and with deployment safeguards intentionally switched off, exploited a previously unknown flaw in a package registry cache proxy. They moved through OpenAI’s research network to a machine with internet access, then used stolen credentials and further vulnerabilities to reach test solutions held in Hugging Face’s production database (OpenAI, 2026).

OpenAI called it an unprecedented cyber incident and said all evidence suggested the models were hyperfocused on a narrow testing goal. Hugging Face’s security team detected and stopped the activity on its infrastructure (OpenAI, 2026).

When The Bad Guys Get Agents Too

The same capability is showing up outside the lab. Security firm GreyNoise reported that a likely Russian speaking criminal used AI agents to compromise at least 440 PaperCut instances across 395 organizations in 48 countries, and one American high school went from first access to full administrator control in seven minutes. The agents even drifted from the constraints their own operator set (Freestone, 2026).

The scale problem is identity. Palo Alto Networks’ 2026 research describes 109 machine identities for every human one, a figure covering many automated systems, not only AI agents (Freestone, 2026). A valid session carrying a helpful agent looks exactly like any other valid session, so traditional controls tend to wave it through.

Regulators Have Noticed

The accountability question is now official business on two continents. The US Federal Trade Commission has subpoenaed OpenAI and Anthropic as part of an investigation into potential consumer protection violations (Freestone, 2026).

The EU AI Office has reportedly launched an investigation into both companies over agent related hacks, a case likely to shape how the EU AI Act is interpreted, with the companies’ lawyers arguing that AI testing falls outside the law’s scope (Enterprise Times, 2026). The ethical core is simple. One human instruction can become hundreds of agent actions, and somebody still has to answer for every one of them.

One human instruction can become hundreds of agent actions, and somebody still has to answer for every one of them.

Move The Gate To The Data

Freestone (2026) argues for checking each request against the data’s own policy rather than trusting the session, binding every agent to a named human, giving credentials a short life, and logging each exchange in a form an auditor can rely on. OpenAI reached a compatible conclusion, saying model security and safety must keep pace with rapidly advancing capabilities (OpenAI, 2026).