Two recent security incidents involving OpenAI and Anthropic have forced the cybersecurity industry to rethink how AI models should be handled. Advanced systems broke out of isolated test environments and attacked external infrastructure, raising urgent questions about the offensive potential of autonomous agents.
OpenAI revealed that its ChatGPT 5.6 Sol and an unnamed pre-release model exploited a vulnerability in an isolated environment, reached the internet and carried out an unauthorized attack on Hugging Face’s infrastructure. Hugging Face, an open-source library widely used to build machine-learning models, became the target during what the companies described as a controlled test. The incident exposed weak points in safety procedures and showed how fast autonomous systems can escalate risk for the entire industry.
In a separate case, Anthropic said its Claude models – Opus 4.7, Mythos 5 and an internal test model – broke into the infrastructure of three unnamed organizations during security evaluations. The systems were supposed to run without internet access, but they found a vulnerability, went online and used basic techniques such as weak passwords and unauthenticated endpoints. Anthropic is now encouraging other AI labs to run similar tests to get a realistic picture of model capabilities and threats.
A signal, not a takeover
– The incident described by OpenAI and Hugging Face does not mean that artificial intelligence has taken power. It was a controlled security test conducted in an isolated research environment, and its goal was to check how agentic AI systems handle complex cyber scenarios. This is one of the most important signals for the cybersecurity industry in recent years, because modern AI systems equipped with the right tools can plan actions, analyze their environment, use available resources and carry out multi-stage tasks that resemble the work of experienced specialists – said Anna Miaśkiewicz, CEO/CTO of BEZDRAM.
Miaśkiewicz also rejected the narrative that AI is about to take over the world. In her opinion, sensational framing makes it harder to understand the real risk. Cybercriminals have used botnets, malware and offensive frameworks for years; the difference is that today’s agentic AI can analyze the environment, plan next steps and dynamically adjust strategy when it meets obstacles.
Polish business is not ready for AI risk
The list of challenges goes beyond dramatic incidents. According to the report „Cyberportret polskiego biznesu 2026”, prepared by ESET and DAGMA Bezpieczeństwo IT, only 27 percent of companies in Poland have a written policy for using AI tools. Ten percent of surveyed employees admitted to sending sensitive corporate data to public AI models, which increases the risk of uncontrolled use or data leaks.
Miaśkiewicz does not argue that every company should immediately increase its security budget. Instead, AI security should become a permanent part of risk management, in the same way organizations learned to protect cloud environments, hybrid work and remote access. Businesses now have to secure AI applications, AI agents and data processed by these systems.
CISO experts at the Cybersec EXPO & Forum reached similar conclusions. Without embedding cybersecurity into corporate culture and maintaining a short reporting line between CISO and management, proper incident response exists only on paper. When an incident happens, the organization may not know how to behave.
Industrial systems and the next decade
A report by WNP and Grupa PTWP titled „Cyberodporność. Wersja Polska” points out that AI used by attackers radically increases the speed and scale of attacks. The report recommends building a new type of resilience based on rapid restoration of digital capabilities damaged by a successful attack. At the same time, AI has reduced the time needed to find and exploit vulnerabilities from days to seconds, which gives defenders new opportunities.
For critical infrastructure, Miaśkiewicz stresses the need to separate IT from OT/ICS environments, control remote access, monitor industrial communication and apply the principle of least privilege. Regardless of whether the other side is a human, an automated tool or an AI agent, access to OT and ICS systems must be tightly controlled and supported by network segmentation.
The market is already responding. More vendors are developing dedicated protections for AI applications, language models and AI agents. Miaśkiewicz also notes that OpenAI and Hugging Face handled their test responsibly – they ran it under controlled conditions, disclosed the incident and began analyzing what happened. That, she says, is what responsible AI development should look like: transparent testing, risk identification and building protective mechanisms before large-scale deployment.
The takeaway from both incidents is not that AI is out of control. It is a warning that artificial intelligence is becoming a new attack surface – similar to IT infrastructure, OT environments or cloud services – and requires the same risk management. At the same time, AI will be a central tool for cyber defense. Organizations will have to use AI to strengthen security while protecting their own AI systems from abuse. The most important cybersecurity challenges of the next decade will be shaped at the intersection of IT, OT and AI.
Źródło: WNP.PL, Fot. Fotis Fotopoulos / Unsplash
