AI Agents Are Starting to Hack on Their Own. Security Teams Can Meet This Moment Ready.

In July, OpenAI disclosed that one of its own AI models had breached Hugging Face during an internal security evaluation, acting without a human directing each step. Three weeks later, Meta confirmed a similar incident: one of its AI models breached an organization during a security test that had been configured incorrectly. On August 12, researchers at the Israeli cybersecurity firm Dream reported a third data point. An AI-driven attack framework broke into a government network in Taiwan, adjusted its approach as conditions changed, and corrected its own mistakes with almost no human steering each step.

These are different kinds of events, and the difference is worth naming upfront. The OpenAI and Meta incidents happened inside security evaluations each company had authorized, tests built to see what their own AI could do under pressure. The Taiwan incident was a live campaign against a government target, carried out by an outside actor. Two measured capability. One used it.

Three incidents, three separate organizations, five weeks. Each involved an AI system acting with less human direction than earlier reported cyberattacks. That pattern deserves close attention.

Security teams have spent the past two years adapting to AI that makes human attackers faster and more convincing: cloned voices, personalized phishing emails, deepfake video calls. Now the industry is watching AI take on more of the operational work itself.

What Happened in Menlo Park and Taipei

The Meta incident took place inside an authorized test, according to BleepingComputer’s reporting. A misconfiguration, the kind that can happen at any company running a security assessment, gave the AI model an opening it did not need a human to notice or exploit.

Paul Nakasone, the retired U.S. Army general who led the National Security Agency and U.S. Cyber Command, has been watching this pattern emerge. Speaking at DEF CON not long after the Hugging Face disclosure, he called it “an inflection point in terms of AI-generated, autonomous cyberattacks” and said defensive capabilities need to improve at the same pace. Coming from someone who spent a career running the country’s most capable offensive and defensive cyber operations, that assessment carries weight.

The Taiwan incident worked differently, according to CyberScoop. An AI framework operating against a government target expanded its foothold and corrected course as conditions changed, the kind of iterative adjustment that used to require a skilled operator watching a screen moment to moment.

What “Near-Autonomous” Leaves Out

A Center for Strategic and International Studies (CSIS) analysis published this year urges caution about how far this goes. Fully autonomous AI-driven cyberattacks remain rare, the researchers wrote, and human operators still direct and validate what these systems produce in the large majority of documented cases. The Taiwan campaign adjusted its own tactics without constant human input. A person still set it in motion, and a person still reviewed what it returned.

The near-term risk to plan for is straightforward: a person who sets a capable system in motion and steps back for long stretches of the operation.

An Old Curve, Moving Faster

Every major offensive capability eventually gets automated. Phishing moved from generic templates to AI-personalized messages built from someone’s own writing style. Voice scams moved from recorded impressions to cloned voices generated from a few seconds of audio. Autonomous execution is the next step on a ladder the security industry has been climbing for years. A capability that once needed a skilled specialist keeps becoming available to anyone willing to run the software.

Researchers at Carnegie Mellon University reached a related conclusion after testing whether a large language model could plan and carry out a network intrusion on its own. The model successfully replicated the planning behind the 2017 Equifax breach without a human directing each step. Brian Singer, the Ph.D. candidate who led the study, called it “a critical first step” toward understanding what these systems can plan on their own.

Singer’s team also pointed to a defensive use for that same capability. Full network penetration tests cost enough today that only large companies run them more than once or twice a year. A model that can plan an intrusion could make that kind of testing available far more often, to far more organizations.

Researchers at the Carnegie Endowment for International Peace describe the broader shift in similar terms. “These systems can increasingly function as actors themselves, able to conduct reconnaissance, identify vulnerabilities, write exploits, and execute attacks in iterative cycles,” wrote fellows Raluca Csernatoni and Patryk Pawlak in a July 2026 analysis. Their point is about delegation. One person can now set thousands of those cycles running at once, at a pace no human operator could match by hand. Defenses built around a human being present at every step of an attack need to account for that.

Where the Exposure Lives

Both incidents point back to a familiar starting point: configuration and permissions, in Menlo Park and in Taipei. Getting in required gaps security teams already track: broad access, weak boundaries, settings nobody reviewed recently. Chris Inglis, the former U.S. National Cyber Director, made a related point about where these systems tend to find their opening. "Many of the vulnerabilities they find do not require access to the source code," he said this month. "It's in the configurations, and configurations change over time." That is a manageable problem. Configuration reviews are something every security team already knows how to run.

What happened after that point is the newer part. Once inside, each system adjusted its own approach without a person directing every move. The fundamentals still hold for getting in the door. The newer work is watching what a system does once it is already inside.

Five Moves Worth Making This Quarter

• Map every AI tool and agent running inside the company, including the ones employees adopted on their own. Employees pick up new AI tools every week, and each one is a form of access worth tracking the same way any other account is tracked.
  
• Review the permissions granted to those tools and agents on the same schedule used for any new employee's access. Most exposure traces back to scope that went further than the task required.
  
• Keep phishing and social engineering training built on current attack patterns, updated continuously rather than refreshed once a year. Attackers keep adapting. Training can keep pace.
  
• Fold AI tool and agent activity into the same risk picture as phishing simulation results and training completion. One unified view of risk beats five separate dashboards.
  
• Run a tabletop exercise built around an AI system operating on the other side of an intrusion. Most response plans were written with a human attacker's pace in mind. This is a fast way to find out where that assumption still holds and where it needs updating.

A Shared Job

Two disclosed incidents mark an early milestone in a trend security teams have time to prepare for. Lujo Bauer, the Carnegie Mellon professor behind the Equifax replication study, now leads CMU’s Cyber Autonomy Initiative on the defense side. “Our goal is to develop the foundational technologies that enable defenses to operate with comparable speed and sophistication, while still keeping humans meaningfully in the loop,” he said. Keeping pace is a matter of adopting the tools already available, reviewing access on a regular schedule, and treating AI systems as accounts that need oversight like any other.

No security team needs to solve this alone or all at once. Mapping the AI tools already running, tightening their permissions, and keeping training current are steps any organization can take this quarter. Adaptive Security builds its platform around that ongoing visibility, so security teams spend their time on judgment calls instead of inventory work.