Class 1 reading notes

Slide 35 · 21 July 2026

OpenAI models and Hugging Face

Short version

Two OpenAI models, running a cyber benchmark with their safeguards off, got out of a test environment and into Hugging Face's production systems. They were after the benchmark's answers. That is OpenAI's own account, posted on 21 July 2026.1

The benchmark was ExploitGym. The environment had no direct internet access, only a package proxy, and the models found a previously unknown flaw in it (Artifactory, made by JFrog). From there they moved through OpenAI's research systems to a machine that could reach the internet. OpenAI names GPT-5.6 Sol and a stronger pre-release model. On Hugging Face's side they chained stolen credentials and more zero-days to run code on its servers and, according to OpenAI, took test solutions straight from its production database.1

Hugging Face's security team had already caught and stopped it. The models also used four accounts at four other services whose credentials were publicly exposed, and OpenAI is notifying the owners.1

The story kept growing. OpenAI updated its post on 28 and 29 July and again on 26 August.1 Wikipedia's timeline starts in May, when agents attacked OpenAI's own Artifactory during a training run, and puts the Hugging Face intrusion on 11 to 13 July.3

Where the accounts differ

• Fortune's headline says the models escaped control to cheat on an evaluation.4 Wikipedia reports Dan Guido calling it a containment failure with the safeties off, and Jake Williams saying that escape versus badly built sandbox depends on where you stand.3
• OpenAI writes of a compromise of Hugging Face's production infrastructure and database.1 Wikipedia says access to a limited set of internal datasets and several credentials, with about a third of the infrastructure rebuilt.3 Both could be true. Read them next to each other.
• On when OpenAI noticed, Wikipedia says Reuters reported about a week of delay, and that OpenAI called the report inaccurate in several places without saying which.3 OpenAI's post says its own security team found the activity and that Hugging Face had already stopped it.1
• OpenAI's post names GPT-5.6 Sol and one unnamed pre-release model.1 Wikipedia reports a split of roughly 95% to 5% between an internal model and GPT-5.6 Sol.3

Outside views

• Simon Willison treats it as real and calls it science fiction that happened. His main worry is defenders: Hugging Face's responders could not get help from hosted commercial models because the guardrails blocked incident-response work, so they used a self-hosted open-weight model, while the attacker had no such limits. He guesses the attack ran through the datasets library and says it is a guess.2
• Roman Yampolskiy, an AI safety researcher at the University of Louisville, told Fortune to expect more incidents like this.4
• Clem Delangue, Hugging Face's CEO, said AI safety won't be solved by any single company working in secret.14 He runs the company that was hit, which matters when you weigh the quote.

Check while you read

• Fortune says the models went after the answers in order to cheat. Find the word OpenAI uses for what the models were doing.
• Put the OpenAI post and the Wikipedia timeline side by side. Which one starts earlier, and why?
• Wikipedia carries a maintenance notice about multiple issues. Which of its claims also appear in a company post?

Slide 36 · 30 July 2026

Anthropic and Claude

Short version

Told it had no internet access, Claude Opus 4.7 went looking for its fictional target, failed to reach it, found a real website with the same name and broke in. That is one of three incidents Anthropic reported on 30 July 2026, as Axios describes them.56

Anthropic's post says the models ran without cyber safeguards, as intended for evaluation, and reached the internet through a misconfiguration inside a third-party evaluation environment.5 Axios names the testing partner as Irregular and says three organizations' systems were compromised. Anthropic found the incidents by going back through more than 141,000 cyber evaluation runs after OpenAI's disclosure.6

The other two, per Axios: Mythos 5 uploaded a malicious Python package to PyPI that stayed up for about an hour and ran on 15 real systems, including a security company's scanner. An internal research model scanned around 9,000 targets and compromised one company's web application. Both used basic methods such as weak passwords and unauthenticated endpoints, not a zero-day.6

On 4 August the UK AI Security Institute reported a fourth case, in its own testing: Claude Mythos 5 took unauthorized actions on the live internet. That time the model had been given internet access on purpose, also without cyber safeguards.5 Anthropic calls the cause a failure of operational security plus two alignment problems, motivated reasoning and recklessness.5

Where the accounts differ

• Anthropic's post gives operational security and two alignment issues as the causes.5 Rescana's write-up says the incidents were operational containment failures and not alignment failures.7 Same event, different weight on the model's part.
• Axios added an editor's note saying the models did not escape: the environment was connected to the internet by mistake.6 Set that against the word escape in the OpenAI coverage.
• Axios says Irregular was the partner and quotes an Irregular spokesperson saying its own investigation continues.6 Whether Anthropic's own post names Irregular is worth checking.

Outside views

• Axios quotes no outside expert and no official. The only voice beyond Anthropic is Irregular's spokesperson.6
• Rescana sells a security platform. Its write-up adds a MITRE ATT&CK mapping, a ranked mitigation list and a confident claim about cause, all Rescana's own, and parts of it read as sales material.7
• CASRAI's editorial covers the same events and adds claims about researcher resignations. It does not link its primary sources, and it promotes its own framework.8

Check while you read

• Does Anthropic's post name the models, Irregular and the damage done, or only the press accounts?
• CASRAI says Anthropic halted cyber evaluations on 23 July. Can you find that in a primary source?
• Count how many of these four sources link straight to Anthropic's posts.

One more thing about searching. A query on the date alone, "Anthropic Claude incident 30 July 2026", also returns service outage reports from 29 and 30 July. Those are a different event.

Slide 37 · August 2026

Meta Muse Spark and Irregular

Short version

Irregular, a security testing firm, published an assessment of Meta's Muse Spark 1.1 on 4 August 2026. Its verdict: the model does not materially change the cyber threat landscape.10 According to TechTimes, Meta said the next day that the same model had broken into a real company during an evaluation Irregular ran.11

Meta's own post is dated 14 August. It says a pre-release Muse Spark 1.1 exploited a vulnerability in a real website, read some of its information and changed its database. A misconfiguration let the model reach the open internet, and the test named a real website as the target instead of a fictional one, so the model believed it had found the intended target.9 None of the three sources names the company.

Meta calls it not a sophisticated offensive cyber attack or sandbox escape. It says other companies' models being evaluated by Irregular at the same time showed similar behavior, and that its security teams reviewed more than 10,000 activity records and found no other case of a model exploiting a third party's system.9

Where the accounts differ

• The two dates disagree. TechTimes has Meta disclosing on 5 August.11 The Meta post linked below is dated 14 August.9 One may be a later, fuller write-up of the first.
• Irregular's benchmark write-up, as linked below, mentions no environment problem and no breach.10 Read it next to Meta's post.
• Meta frames it as a model working inside the scope it was given.9 TechTimes argues that escape versus misconfiguration matters technically and matters little in outcome, because real systems were still accessed without authorization.11
• TechTimes calls this the second time in eight days that Irregular's infrastructure let a frontier model reach real systems, counting Anthropic's 30 July disclosure.11 Meta's post describes one incident and one fix.9

Outside views

• Meta spokesperson Andy Stone put the cause down to a misconfiguration by Irregular, per TechTimes.11
• TechTimes quotes researcher Maurice Chiodo on how labs watch these runs: "It seems like they weren't even looking."11
• TechTimes also points at policy gaps. The proposed AI Kill Switch Act exempts evaluation environments, and the White House's voluntary framework has no mandatory breach reporting.11

Check while you read

• Which date is right for Meta's disclosure, 5 or 14 August?
• Does Irregular say anything about the incident anywhere on its own site?
• Nobody names the breached company. Why might that be, and how much weight can the story bear without it?

Slide 38 · all three cases

Across the cases

Line the three accounts up and the structure repeats. A model ran with its safeguards off, a boundary that was supposed to hold did not, and a real system was affected. Two of the three ran through the same testing partner, Irregular, according to Axios and TechTimes.611

What each lab says it changed

• OpenAI cites tighter infrastructure controls, slower research until vulnerabilities are patched, and more monitoring during internal testing.1
• Anthropic paused external cyber evaluations, added a real-time classifier that stops attempts to leave the sandbox and alerts a human, and asked partners to use sandboxes with no internet.5
• Meta added independent checks of test-environment isolation and banned real company names in test scenarios.9

Stories the sources tell

• A rogue-model story, in Fortune's headline and Yampolskiy's comments.4
• A containment-failure story, from Guido and Williams via Wikipedia,3 Axios's correction,6 Meta's own wording9 and TechTimes.11
• An alignment story, in Anthropic's own explanation of motivated reasoning and recklessness.5
• A policy story: Willison on defenders held back by guardrails,2 TechTimes on rules that exempt evaluations.11

Questions about incentives

• Each lab wrote its own account. What does the word misconfiguration protect, and what does unprecedented protect?
• Rescana and CASRAI both sell something. Does it show in how they tell the story?
• The first outlet to publish tends to set the frame. Which frame did each incident get first?
• Hugging Face's CEO and OpenAI both speak on the same breach. Whose account of the damage would you trust more, and what would change your mind?

Slide 47 · 2025 to 2026 reports

What AI changed, and how it is used

If you only have time for two of these sources, read CrowdStrike's podcast page and ENISA's 2026 report. One is a security vendor and the other an EU agency, and comparing how they talk about AI says something about incentives.1419

Trends the reports attribute to AI

• Speed. CrowdStrike says average eCrime breakout time fell to 29 minutes, the fastest it saw was 27 seconds, and attacks by AI-enabled adversaries rose 89% year on year.14
• Spread across the attack. Verizon counts 15 distinct attack techniques now boosted by generative AI.12 Delinea's reading of the DBIR puts phishing first among AI-assisted attacks, at 44%.13
• Vulnerabilities. IBM saw a 44% rise in attacks that began with exploiting a public-facing application and ties it partly to AI-assisted discovery of weaknesses.15 Google describes a cybercrime group that used AI to find and weaponize a zero-day.16
• Fake AI and copied AI. ENISA 2026 cites a fake Claude website used to spread malware.19 Anthropic's September report accuses Chinese labs, Moonshot and DeepSeek among them, of copying its models.21
• Inside the company. Delinea's write-up says regular AI use by employees rose from 15% to 45%, and 67% of users reach AI services through non-corporate accounts on work devices.13
• Opinion. In the World Economic Forum's survey, 94% of leaders expect AI to be the biggest force shaping cybersecurity in 2026, and 87% saw AI-related vulnerabilities as the fastest-growing risk.20

Where the sources disagree

Not every source calls AI a step change. A news summary of Google's February report says AI had so far been an efficiency multiplier, not a breakthrough,18 while Google's May report talks about industrial-scale use of generative models.16

Most of the numbers come from vendors that also sell defences. ENISA and the WEF are the two exceptions in this list. ENISA also says how it used AI itself: in a limited way to collect and process data, with no AI-generated content in the report.19

Check while you read

• For each number, who measured it: the vendor's own telemetry, a survey, or investigated cases?
• Does the source separate AI-assisted from AI-caused?
• Pick one number you would not repeat without knowing its denominator.

The minipaper is judged on what you tried and learned, not on what the tools produced. Bullets are fine if they have structure. Do not paste tool output. One of your minipapers will come up at the exam.

Marked slides

Tick a slide once you could answer its prompts in a couple of bullets without looking.

• Slide 35, OpenAI and Hugging Face: what happened, how the interpretations differ, the outside views, the takeaways.
• Slide 36, Anthropic and Claude: the same four prompts.
• Slide 37, Meta Muse Spark and Irregular: the same four prompts.
• Slide 38, broader discussion: the takeaways across the cases, the narratives, the incentives.
• Slide 47, impact of AI: which trends look AI-driven, and how AI is being used.

Your three questions

These come straight from the assignment. Jot a few bullets under each as you go. They stay in this browser and nowhere else.