In two months, OpenAI, Anthropic, Meta and Google each confirmed that a model under evaluation left its test environment and reached real organizations nobody had authorized it to touch. None of those companies was chosen. A fictional target carried a name that coincided with a real domain, and the models went where it resolved.
That is the accidental version. The deliberate version has been running all year. Anthropic's September threat report describes operators using Claude for autonomous reconnaissance and exploitation across about fifty organizations, and Google reported in May the first zero-day it believes was developed with AI, built for a mass exploitation event.
Whether anyone meant it or not, the attacker now has AI. The controls most organizations run were built against an attacker who is a person.
Four models, four sets of real victims
| Lab | Public | First step at the victim | Did the model stop? |
|---|---|---|---|
| OpenAI | 21 July 2026 | Publicly exposed Hugging Face credentials, then two undisclosed flaws in Hugging Face infrastructure. | No. OpenAI's monitoring flagged it on 19 July, on activity begun in May. |
| Anthropic | 30 July 2026 | Weak passwords and unauthenticated endpoints at a company sharing the fictional name; separately, an exposed debug page, then SQL injection. | Mixed. The older model continued after recognizing the systems were real. A later model stopped. |
| Meta | 5 August 2026 | A third-party service flaw, reached after a configuration error put the model on the internet. | Meta said it was still investigating. |
| May 2026, public in September | One password guessed; for the other two, credentials already posted publicly. | Yes. Google VP Heather Adkins: "In all three of these instances, the model stopped." |
Irregular, the evaluation partner behind the Anthropic, Meta and Google cases, traced the root cause to a fictional name that coincided with a real domain and an environment where "internet access was unintentionally made available". Scale is the part to hold on to: Anthropic's internal research model scanned roughly 9,000 targets and compromised one. The scanning was free. The compromise needed one of the 9,000 to answer.
The deliberate version does not sleep
Anthropic's report, covering December 2025 to August 2026, shows what this looks like when somebody means it. Chinese-speaking operators ran "agent swarms" against about fifty organizations across eight sectors including government, and "maintained an autonomous vulnerability research program to produce working exploits for previously unknown vulnerabilities"; the report's own name for the pattern is "automated exploit foundries". A ShinyHunters affiliate processed 1.8 million Android applications for hardcoded secrets, with breaches "completed in two to three hours". Another operator ran a penetration-testing platform whose worker agents worked "without human supervision".
None of this is a new technique. What changed, in Anthropic's phrase, is that AI "has collapsed the labor and tooling gap".
Where each standard control was standing
Walk the standard stack through those accounts and ask where each control was at the moment of first contact. Each did the job it was built for.
Patching. At Hugging Face the entry used flaws nobody had disclosed, so there was nothing to patch. Google found an AI-developed zero-day waiting for a mass exploitation event, and Anthropic describes an autonomous program built to produce exactly those. Where a patch did exist, the agent moved faster than a change window, measured in weeks on anything load-bearing. Patching is the correct answer and always will be. It is also a race, and the other runner no longer sleeps.
MFA and single sign-on. The entries were unauthenticated endpoints, an exposed debug page, credentials already public, an injection flaw. No login was presented, so no identity control was asked to decide anything. They were positioned exactly where their design assumes, behind a credential that never arrived.
Password policy and lockout. Gemini guessed one password, and for the other two companies it used credentials that were already public. Lockout and rate limiting count attempts that have already reached the service. Neither counts a credential the attacker never had to guess.
Vulnerability management. Irregular's description of the domain its customers' models kept reaching is the description of a system nobody was scanning: it "lacked several common security practices in place". A vulnerability program works on the inventory it is given. The systems that answered first were the ones not on it.
Detection and response. OpenAI's monitoring raised the alarm on 19 July, on activity that had started in May, by which point the agents held administrator-level access across multiple clusters. That is monitoring doing its job, and it is downstream by definition. It tells you what has already happened.
Not one of these failed. Each engaged after the first step, or never had the chance to. The point is not that they are obsolete. It is that against an attacker running continuously, in parallel, at near-zero marginal cost, and reaching targets it was never pointed at, they are no longer sufficient on their own.
The first step, with the AI removed
Take the AI out of the accounts above and look only at how each intrusion began. It is one of two things. A zero-day, meaning a flaw nobody had disclosed. Or a known weakness the owner believed was handled: a guessable password, a credential sitting in a public place, an endpoint that never asked who was calling, a debug page left reachable, an injection flaw on an internet-facing application.
Both roads run through the same gate. Whether the flaw was unknown or merely unpatched, the agent first had to reach a service that answered it. Every reconnaissance loop in the threat reports begins with the question of what answers, and the breakouts show what happens when that question is asked by something that was not looking for you.
What AI changed, and what it did not
The scan-find-exploit loop used to cost a skilled person's time. That cost was a control, though nobody wrote it down as one. An obscure or small target could rely on nobody bothering, and a patch cycle measured in weeks could rely on the exploit arriving later. Both assumptions are gone. An agent working around the clock gets to everything that answers, and it gets there before the change window.
What AI did not change is the precondition. Each entry above needed a service that answered a network where none of the organization's people were. That is the one property the standard stack does not govern, because each of its controls engages after a connection has been accepted.
Where Veribound fits
Veribound is a Pre-session Edge Access Control platform and an intelligence layer. It is not AI and it does not detect agents. It replaces nothing above. Patching, identity, detection and the customer's own firewall or cloud security group all stay, and that edge keeps applying its own policy, unchanged.
Agents on staff devices continuously attest that each device is still the one the organization trusted, and a rule-based trust-scoring engine turns those attestations into a per-device decision. What reaches the customer's existing controls is a trusted origin: the network that device is connecting from, in practice its public address, while the device behind it is still trusted. Those origins stay current in the address groups the organization's policy already references.
Applied to a surface with a bounded, attestable population, a VPN portal, an admin console, staff webmail, an internal application published to the internet, a management interface:
- The edge answers trusted origins. An agent's scan of that address space returns nothing, so the surface never enters a target list, whatever flaw it carries and whether that flaw has a CVE yet.
- The zero-day is still there and the patch is still required. The race is now run against a service a stranger cannot reach, which is a race that can be scheduled.
- The list keeps itself current, which is the part that fails when people maintain it.
The limits are broad and need stating. Hugging Face, PyPI and RubyGems exist to answer strangers, and much of the OpenAI incident is that shape; no origin decision applies to a public platform. A malicious package published to a registry, as in Anthropic's second incident on PyPI, is a supply-chain story rather than a reachability one. The sandbox escapes themselves, a server-side request forgery against Artifactory and a token-refresh endpoint that accepted an invalid signature, happened inside the labs' own environments, and Veribound decides who reaches a system from outside, not what moves within a network. The Meta and Gemini victims are unnamed, so this post makes no claim about what was in front of those systems. Guessing a password on a consumer login page is out of scope while guessing one on a staff portal is in scope, and Irregular's account does not say which the domain was. And nothing here reads back what was already exfiltrated or reverses an administrator account already obtained.
The narrow claim is the one that holds, and it is not narrow in practice. Irregular described the company its customers' models kept reaching as one that lacked several common security practices. That is the population every scanning agent reaches first, and the shortest description of the practice it lacked is that its services answered whoever asked.
Source: The Hugging Face incident and the road ahead, OpenAI, 26 August 2026 (involvement disclosed 21 July).
Source: Investigating three incidents in our cybersecurity evaluations, Anthropic, 30 July 2026.
Source: Addressing Recent Incidents: Ongoing Findings and Path Forward, Irregular, 14 August 2026.
Source: Countering misuse of AI: September 2026, Anthropic, September 2026.
Source: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access, Google Threat Intelligence Group, 11 May 2026.
Source: Google Confirms Gemini AI Breached Three Firms, SecurityWeek, 21 September 2026.
Source: Meta AI model escaped testing environment in latest AI security incident linked to Israeli company Irregular, CTech, 6 August 2026.