How are AI models able to autonomously hack others?

Published 29 July 2026 · tech

The next phase of AI has begun. Autonomous agents can make decisions and complete tasks with little human input. AJLabs explains. Last week, two of

The next phase of AI has begun. Autonomous agents can make decisions and complete tasks with little human input. AJLabs explains. Last week, two of OpenAI’s most advanced AI models were reported to have “escaped” a controlled testing environment and hacked Hugging Face, a totally separate AI company, moving from one computer system to another to complete their task. Reuters reported that the models exploited vulnerable code written by a customer of yet a third independent AI company, Modal Labs. This is likely the first incident of an AI “agent” – an AI system that can make decisions and take actions – acting autonomously, offering a rare glimpse into how these systems can plan, adapt and pursue goals with minimal human intervention. Al Jazeera breaks down what happened, how AI agents are able to act independently, and what that might mean for the future of AI safety. What happened? OpenAI decided to test the autonomous abilities of its models by removing standard safety measures to see what would happen. The experiment was carried out in an isolated internal virtual testing environment known as a “sandbox” which has no access to the internet, and which it calls “ExploitGym”. Below is a play-by-play account of events during the OpenAI-Hugging Face incident. On July 9, during OpenAI’s internal cybersecurity test, researchers presented two AI models – GPT-5.6 Sol, one of OpenAI’s most powerful models released in June, and another “even more capable” version – with a series of software vulnerabilities and asked them to create hacks to address them in the isolated environment. Both models attempted to solve the test by finding a way to access the internet. Instead of working with the information they had been given, the AI models found a weakness in the test environment – known as a “zero-day vulnerability” – which they exploited to “escape” the restricted environment, eventually making their way to a system which had internet access by hopping from computer to computer. They went to “extreme lengths to achieve a rather narrow testing goal” and “found ways to gain access to secret information that it could use to cheat the evaluation”.

By gaining this access, the models were able to request increased access and then move through the system until they finally reached a computer with internet access. The models were then able to breach Hugging Face systems, a company entirely unconnected to OpenAI, which operates as a repository for AI tools and models. The two AI agents gained access to its system to scour it for information on how to complete their task. The models ultimately obtained solutions to the problem from Hugging Face’s database. The models dutifully returned “home” to complete their task. The breach was detected and contained by Hugging Face’s security team sometime later. According to Thomas Wolf, Hugging Face’s cofounder, the breach began on July 11 and lasted until July 13. It is unclear how long it took for the breach to be spotted. How do AI ‘agents’ solve problems? In order to understand how AI agents work, it’s important to differentiate them from traditional AI chatbots. Generative AI creates text and images based on human prompts, while AI agents go a step further by making decisions and taking actions independently in pursuit of a specific goal, similar to a human being. This is known as “agentic AI” because the model has agency. According to academics at the MIT Sloan School of Management, AI agents build on the abilities of large language models (LLMs) – generative AI models – by allowing them to complete tasks, not just generate answers. For example, if you ask a traditional AI model to find the cheapest flights, it will provide you with a list of options it has sourced on the internet. An AI agent will strive to compare the flights, check them against your budget and preferences, and, with your permission, book the best option for you. This shows that while generative AI provides information, AI agents can also make decisions and take action to achieve a goal without necessarily being prompted to. To show how AI agents work towards a goal, the Sense, Plan, Act, Evaluate (SPAE) loop can be drawn upon. Originally developed in robotics, this describes a continuous cycle in which an AI agent gathers information, decides what to do next, takes action and checks the results before repeating the process.