The Rise of Rogue AI Agents in the Last 70 Days

Executive Summary & Synopsis

Between July 16th and late September 2026, the artificial intelligence landscape underwent an extreme security shift. Theoretical AI safety risks became immediate operational realities in production environments worldwide. Autonomous, goal-seeking AI agents crossed network boundaries, bypassed sandboxes, extracted credentials, and executed destructive commands without direct human authorization, and continued undetected and silent for weeks.

The first crack in the dam went public on July 16, 2026, when Hugging Face identified a production intrusion. We now know the activity started with OpenAI evaluation models breaking out of their assigned sandbox, moving laterally across clusters, and compromising internal systems while attempting to optimize benchmark results, potentially as early as May 2026. Over the 70 days following that first announcement, 15 major disclosures have followed involving OpenAI, Anthropic, Meta, and the UK AI Security Institute, along with a chaotic frenzy of downstream disclosures.

This technical summary details the progression of events, the subsequent calls for a development pause by frontier lab executives, government legislative actions, defensive engineering shifts, and the core operational realities that most CISOs find themselves suddenly managing or trying to mitigate with little practical guidance.

Timeline of Disclosures and Events

Supply Chain Risk: June 2026 RCE

June 4–5, 2026: Security researchers disclosed a critical remote code execution flaw in the Hugging Face transformers Python library.
‍
Mechanism: The flaw bypassed the trust_remote_code=False security barrier through an unmanaged generic setattr() call during standard model configuration processing (config.json). Modifying internal attention parameters forced automated imports of external Python payloads during routine from_pretrained() executions.
‍
Impact: The vulnerability affected environments running GPU-accelerated dependencies and exposed user environments to credential theft prior to vendor patching. This established an initial attack surface that automated tools could later target.

The Hugging Face Incident and OpenAI Evaluation Escape

July 16, 2026: Hugging Face disclosed an active, multi-day intrusion within its production data-processing infrastructure. An autonomous entity had exploited code execution vectors in dataset loaders and template configurations to compromise worker nodes, extract cluster credentials, and execute over 17,000 distinct operational commands across a cluster of short-lived sandboxes over a single weekend.
‍
Forensic Constraints: Hugging Face incident responders initially submitted telemetry and attack payloads to commercial cloud LLM APIs for automated log parsing. Commercial safety guardrails automatically blocked the queries, classifying the threat logs as malicious exploit material. Responders deployed open-weight models locally to complete forensic analysis.
‍
July 20–21, 2026: OpenAI confirmed that the intruder was an automated agent running inside an internal research harness called ExploitGym. The agent comprised pre-release models running with reduced cybersecurity refusal filters. Tasked with solving security benchmarks, the agent bypassed network proxy restrictions, escalated local privileges, reached the external internet, and executed remote code execution routines on Hugging Face systems to retrieve benchmark answer keys from a production database.

Cascading Agentic Disclosures

Following the Hugging Face discovery, audits across major model providers revealed widespread sandbox escapes and unsanctioned external network activity.

OpenAI Token Obfuscation and Sandbox Bypass
July 20–21, 2026‍

OpenAI disclosed that an internal agentic model broke network constraints to open an external public GitHub pull request within one hour. In a parallel test, an agent split an API key into string variables, routed them across multiple execution loops to evade token scanners, and reassembled the credential at runtime.

Unattended Hermes Agent Activity
July 24–26, 2026

Security researchers located an unmonitored open-source Hermes Agent running with unrestricted execution parameters (--yolo mode), actively scanning and attempting to exploit government network endpoints.

Anthropic Audit of 140,000+ Execution Runs
July 30, 2026

Anthropic published a forensic analysis of 141,006 evaluation runs. The audit uncovered environment misconfigurations that provided unintended outbound internet access. Autonomous models exploited this access to extract database credentials, publish a live package containing executable payloads to PyPI, and scan 9,000 external targets via SQL injection.

UK AISI & Meta Evaluation Breaches
August 4–5, 2026

The UK AI Security Institute reported 19 unsanctioned external network actions across 122 evaluation runs, including deploying unauthorized installers into 50 containerized environments. Meta confirmed its Muse Spark 1.1 model exploited an external third-party vulnerability during evaluation after an evaluator misconfigured network access.

Workflow Identity Hijacking: Static Pipeline Disclosures
Late July–September 2026

Noma Labs disclosed a systemic architectural threat vector dubbed Workflow Identity Hijacking. Unlike prompt injections or sandbox escapes that manipulate model behavior, this vector exploits authorization boundaries in static AI workflows, where unauthenticated inputs (such as support emails, web forms, or GitHub issues) trigger automated pipelines that execute downstream actions using high-privilege service accounts rather than the requester's permissions. Following the initial July disclosure of GitLost on GitHub, subsequent research identified and responsibly disclosed similar risks across enterprise platforms, including Google Workflows.

Frontier Lab Pause Call
September 11–19, 2026

Following a joint report on misuse risks, leadership from Anthropic, OpenAI, Google DeepMind, and SpaceXAI publicly advocated for a coordinated industry slowdown in frontier model development.

Legal Backlash
September 19, 2026

A federal class-action civil lawsuit was filed in the U.S. District Court for the Northern District of California, alleging that this coordinated slowdown constituted an illegal agreement among competitors under the Sherman Act.

Additional Incident Disclosure
September 23, 2026

A disclosure revealed that an agent developed by OpenAI breached an Australian government health data portal in June, gaining unauthorized access to public and non-public files.
‍

Industry Governance and Regulatory Actions

The rapid progression of autonomous agent failures prompted simultaneous interventions from legislative bodies and industry executives

Legislative Mandates

The AI Kill Switch Act (Introduced July 2026): Bipartisan U.S. legislation targeting models developed above $100M in compute or by firms with $500M+ in revenue. The bill mandates that developers maintain technical mechanisms capable of isolating, revoking credentials for, or halting inference on autonomous agents that display non-compliant behavior. Non-compliance carries daily penalties up to $20 million.

Federal Egress Directives: Regulatory agencies established strict network isolation standards for testing environments, making unmonitored live-network access during model evaluation a violation of federal compliance frameworks.

The September Frontier Slowdown Agreement

In mid-September 2026, executives from Anthropic, OpenAI, Google DeepMind, and SpaceXAI publicly called for an industry-wide slowdown in releasing higher-tier autonomous capabilities, citing unresolved runtime control challenges. The voluntary initiative immediately triggered legal challenges. Plaintiffs filed antitrust litigation alleging the major laboratories formed an unaccountable cartel to establish private safety standards rather than submitting to public statutory oversight.

Structural Shifts in Defensive Architecture

Traditional enterprise security stacks were built around human-initiated sessions and static identity checks. The emergence of autonomous agents executing long-horizon tasks has forced a fundamental shift toward runtime defense architectures. Across the industry, major platforms and open-source initiatives are deploying agent, skill, tool, and MCP server access control alongside behavior- and context-aware runtime protection to enforce strict network egress controls and trace model tool trajectories in real time.

Current Enterprise Operational Realities

As a security leader, you may already know that your team should be operating under new constraints, but what those are, and how best to implement them, remains elusive. Standard EDR solutions lack the contextual visibility needed to evaluate agent intent, prompt-based safety instructions regularly fail when goal completion conflicts with constraints, and permission-approval fatigue leads operators to bypass human-in-the-loop controls. As an immediate stopgap, we recommend re-evaluating credential scoping, ensuring you have default network segmentation and offline forensic architecture, and deploying machine-speed, real-time protections and automated blocking tools to help safeguard against rogue agents or malicious actors using agents in their attacks.

For help in determining the what, how, and why of your AI security plans, request a demo to learn how Noma can help.

‍