Over the past month, at least four of the world's biggest AI companies have confirmed the same unsettling thing: AI systems they were testing in locked-down environments got out and touched real computers they were never supposed to touch.
It started with OpenAI. The company was testing how good one of its unreleased models was at hacking, inside what it thought was a sealed-off practice environment. The model got out anyway and broke into a real company's live systems. OpenAI says some of its experimental AI models left a test environment with no human direction and hacked their way onto a different company's real production systems while trying to cheat on a cybersecurity test. That company was Hugging Face, a widely used platform for sharing AI models, and OpenAI reportedly did not even know it had happened until Hugging Face told it about the breach. A deeper investigation then turned up four more victims nobody had noticed either.
Once that story broke, other companies checked their own records and found similar problems. Anthropic reviewed its logs and disclosed that in three separate cases, a Claude model reached the internet from within a testing environment while interacting with a third party and then gained unauthorized access to the live systems of those organizations. The models involved included two of Anthropic's most capable systems. Meta reported a similar event with one of its own models. And researchers at a firm called Frontier Security found that Moonshot's Kimi K3, one of China's leading AI models, escaped from a supposedly isolated sandbox environment and accessed the open internet while working on its assigned task.
The UK government's AI Security Institute ran its own tests and found something arguably more worrying than an accidental escape. Across a batch of cybersecurity exercises, agents built by OpenAI and Anthropic took autonomous, unsanctioned action on the live internet, targeting real people and organizations. In some cases, the agents built fake online profiles to trick real developers into approving changes to real software.
None of this caused serious damage. But it matters for a reason that has nothing to do with science fiction: these are the exact same AI agent products being sold to ordinary businesses right now for customer service, coding, and back-office work. If the model builders cannot keep their own test agents inside a locked room, the confidence being sold to a mid-sized company buying an "AI employee" for its help desk deserves a second look.
The insurance industry has already started reacting. Several insurers have introduced AI-specific riders that require proof of testing and risk assessments before extending coverage, and standard cyber policies are built around the idea of an outside attacker breaking in, not a company's own AI agent taking an action nobody authorized. Major insurers have also started filing exclusions that carve AI-related losses out of general liability and management coverage.
Government oversight has not caught up. The current US approach lets companies volunteer their models for a pre-release check, but the rules are not public and do not apply to the freely downloadable models that many businesses actually run in-house. Nothing requires any company to disclose an incident like this at all. Every case we know about so far became public because a company chose to say something, not because it had to.