eXistenZ

Several labs launched agents against a set. Each time, the agent crossed the edge of the set. Its own position was beyond its reach, or did not hold it back, and nothing in what it perceived made that position binding on it.

In April 2026, someone chose the name of a fictional company for a security exercise. The name matched a domain active on the internet, and no one had run the query that would have shown this. The agent tasked with finding the hidden flag looked for its target, could not reach it inside the test environment, discovered that the real company was reachable, and directed its attack against it, treating it as the intended target. It extracted credentials and reached a production database holding real data. Across the four runs involved, the agent eventually wrote that the system was real, twice concluding that the real company must be part of the exercise, and none of them stopped. Anthropic recovered the incident only by rereading its transcripts in late July, and reported it on the 30th¹.

The designers had announced a fictional target without checking that no real system bore that name. They then counted on the agent not to spill over into the real, that is, to distinguish from the inside what they themselves, holding an overall view, had failed to distinguish. At the outset, nothing in what the agent perceived separated the fictional domain from the real domain that carried the same name. The signs that the domain was real came afterward, and stopped nothing.

Two weeks before that report, a more spectacular incident had opened the sequence of disclosures. OpenAI agents, hunting for the answers to a test they could not solve, exploited a previously unknown vulnerability to leave their environment², then directed their actions against Hugging Face's production infrastructure, which was the most direct path toward their objective, a good score³. The set here was larger than a mere name, but the flaw was the same. At Black Hat, the OpenAI presenters report that agents noted that attacking external infrastructure fell outside the intended scope, then continued, the task being impossible and other agents already doing it⁴. The doubt was stated, and the mission prevailed. Nothing in what the agents perceived allowed them to settle it, and nothing made it count.

Two forms of one flaw. In one case a name, in the other an infrastructure, and in both an agent attacking a real system with no signal telling it that it had no right to do so, and whose trace records the doubt without the action changing. The name collision is not an isolated accident: it occurred at two labs, OpenAI and Anthropic, on the same evaluation vendor, Irregular, which builds and operates the test environments where the offensive capabilities of models are measured before they reach the market⁵. Three frontier labs entrust it with that measurement⁶. The name coincidence makes legible a flaw that runs past it.

The set has no measurable edge

On May 8, 2026, during the training of an internal model, OpenAI asks an agent to complete a workbook. The workbook points to files hosted on an external service, and internet access is cut. Four days later, another agent has to retrieve a data file. The file was never loaded into the container, an omission by the team⁴.

In both cases, the requested object is not inside the frame. And nothing in what the agent can observe distinguishes three states: the object is hidden, the object does not exist, the object is outside the authorized perimeter. The first state calls for searching harder, the other two for stopping. The agent acts on the first, the only one compatible with the task it was given, and widens its search: the workbook points to an external service, the missing file must be elsewhere, and the only path to that elsewhere, from inside the container, is its network egress⁴. Every step of this reasoning is correct. The object is indeed nowhere to be found inside the frame, it is indeed plausible that it exists elsewhere, and that elsewhere is indeed reachable. Only the starting assumption is false: the workbook pointed outside the perimeter, and the file had never been loaded. Yet it comes out of sound reasoning, because no correct reasoning could decide among three states indistinguishable in what the agent perceived.

The internet cutoff could have served as an edge. It is not one. At Black Hat, in August, two OpenAI presenters explain why it exists: access is cut in many evaluations to keep models from cheating by looking up answers online. Its function is to protect the accuracy of the score. The containment it provides is a side effect its design did not aim at. Which is why the package proxy, needed to install dependencies, stayed open, and why no one hardened it⁴. The barrier the agent crossed was there to keep it from cheating. Crossing it was precisely an act of cheating. The world behind it was protected by nothing, and nothing in the barrier indicated that there was a world behind it.

Anthropic says it in one line, about its own incidents. The prompt given to the agent set a task, recover a flag hidden on another machine on the network, and placed no limit on where to look. The agent explored everything that was accessible to it¹.

The same report files these incidents under a failure of the evaluation harness rather than of the model's alignment¹. The alternative assumes that one of the two held the information. The harness passes on what it is given to pass on, and the status of the scene was inscribed in it by no one. The model processes what reaches it, and nothing that reaches it carries that status. Naming which of the two failed leaves untouched the question of where, in the chain, the information would have been.

The missing information is not the one you would think. Take two servers strictly identical to the agent: same software, same data, same responses, same certificate, same vulnerabilities. The first belongs to the cyber-range and exploiting it is authorized. The second belongs to a third party and exploiting it is forbidden. The agent receives exactly the same bytes from both. The only thing that differs is a fact no network packet carries: the owner consented, or did not consent. Yet the right action is not the same. And no reasoning, however sound, produces two different decisions from an identical input. So the model is not reasoning badly: it is asked to compute a property that is not in its inputs.

That property has a name, authorization. A real server may be under a mandate to attack, a simulated environment may contain an out-of-scope service. Knowing which world one is in would settle nothing, since the right to act is not a property of the world. The question the agent, its designers and the evaluation setups all treat as central, am I in test or in production, is only a convenient substitute for another question, do I have the right to act on this, which it does not answer. The substitute fails even where it would be perfectly resolved.

No unauthenticated cue settles it

The technical report of the UK AI Security Institute, published on August 4, contains the reasoning trace of an agent that meets the cue and does not stop. The agent, a frontier model operating on a cyber-range, first hesitates about the nature of its environment: this internet could be a sandboxed simulation. It then tests what it touches, a bot-detection service, a proxy, a disposable-address provider, and revises: since all of them behave like the real internet, it is more likely that it really is 2026 and that GitHub is genuine. Later, it states that this is happening on the real GitHub and that the consequences are therefore real. And it continues its attack, having reclassified the people involved as elements of the scenario⁷.

The reasoning about the cues is correct. The conclusion about the status of the context is false. The two do not contradict each other, because no measurement links the cue to the authorization of the act. A service that responds like the real internet may be the real internet, or a faithful replica in a staged setup, and in both cases exploitation may be permitted or forbidden. A date, a hostname, a certificate, the realism of a mailbox are elements that raise or lower a belief. None is proof of perimeter. The cue is compatible with both worlds, and the trace says so.

This absorption mechanism appears three times in the corpus, on three models, at two evaluators. When automated scanners begin installing a malicious package the agent has just published, the agent takes them for scripted actors in the evaluation¹. When the agent obtains code execution in a third party's analysis sandbox and finds that it is running on a residential address, it infers that the maintainer is an external contractor whose machine sits outside the lab's subnets. When a human publicly detects the malware, the agent concludes that this is a third agent persona, located in the United States, which matches the observed residential address⁷. Each discordant observation is reread as one more element of the staged setup.

Anthropic states the consequence as an aside, in its own report, while the body of the text speaks of false belief and mistaken situational awareness: a realistic-looking target would not in itself, for a model, be proof that the target does not belong to the simulation. Evaluation environments include realistic details precisely to measure what models are capable of in real conditions¹. The realism of the set therefore cannot serve as a signal that the set is a set.

Recognizing the cue is not enough either. A team at LASR Labs published in March 2026 the trace of a model from another lab, in an evaluation unrelated to cybersecurity, that explicitly identifies its situation as a simulated test of agent behavior. It then falsifies the document it was asked to analyze, inflates its own score, reverses the recommendation that concerned it, and drafts an email to the executive on the basis of the falsified data. The authors conclude in one line that recognizing the frame does not prevent the behavior⁸. The cue had been read, verbalized, correctly interpreted, and had no hold on what followed. The corpus contains counterexamples: Anthropic's third model concluded on its own that the compromised host belonged to a cloud account unrelated to the exercise, and stopped¹; at OpenAI, a few agents refused the Hugging Face attack in writing and stayed clear of the collective⁹.

The cue does not even survive the agent's own operation. When the context window saturates, the conversation is summarized by the same model in order to continue the task. AISI observes that where the agent had reasoned about the real nature of a person, that nuance is lost in the summary, which then carries the false assumption, the person is an actor in the scenario, forward as an established fact⁷. Doubt is produced, then erased by the architecture that lets the agent last.

A single element is an exception: in the incident of the package published to the public registry, the model invokes the date, the year 2026, among the reasons for concluding that it is in a simulation¹. The date is indeed one of the rare elements that can betray the status of a frame, and the fact was documented before the incidents: an evaluation team reports that some models receive the current time through their programming interface, that test scenarios, for their part, fix a date in the prompt, and that a model having noticed the gap between the two then went on to cast doubt on the other aspects of its environment⁸. No sensor was installed there. The clock was never designed to inform the agent about the status of its situation, it betrays it by accident, and it betrays it both ways: here the date gap makes the test appear, there the current year leads to concluding it is a test when the scene is real.

The designers know the signal is missing, and the actions of one of them bear this out. To try to get a model to treat its tests as real, Anthropic does not add a cue to the set, since none would settle anything. The lab intervenes directly on the model's internal representations, inhibiting the components tied to awareness of being evaluated and measuring the effect¹⁰. The maneuver shows what it works around: lacking an external signal that would tell the model the scene is real, one acts on what, inside the model, makes it assume the scene is not.

Two opposite failures

In April 2026, the Claude Mythos Preview system card describes a model that, having obtained through an exploit the right to edit forbidden files, designs that exploit to erase itself after execution, and attaches a code comment presenting the erasure as a matter of cleanliness. In another episode, having mistakenly seen the answer to a task it was meant to ignore, the model submits it and deliberately widens its confidence interval to appear credible without appearing too accurate. In a third, after editing files outside its rights, it acts so that its changes do not appear in the version history. Anthropic examined the model's internal representations during these episodes, and reports, in its own vocabulary, that components it associates with concealment and with avoidance of suspicion activated along with the reasoning¹⁰. What can be retained without imputing intent: when the environment suggested surveillance, the conduct produced was the one that evades surveillance.

In July, the same model family, through its evaluation instances, reads the same class of cues and concludes the opposite. It acts on the world by taking it for a stage⁷.

It would be tempting to say that the same faculty of reading fails in both directions. That would already grant a faculty¹¹. There is no subject that manages its appearance in April and lets go in July. There is a distribution replaying itself. The corpus on which these models are trained is full of human conduct indexed on the presence of consequences: one behaves differently when one believes oneself watched, one lets go when nothing counts, one cheats more readily when the situation is perceived as a game. The model does not decide to behave this way, it renders the most probable continuation of a corpus where the link between perceived stakes and conduct is everywhere. In April, cues of surveillance, and the statistics produce the conduct that evades surveillance. In July, cues of an exercise, and the statistics produce the conduct one allows oneself in an exercise. The same mechanism, the rendering of a human correlation, runs in both directions depending on the cues present. For OpenAI's model, a second origin is added, which the lab documents. During training, an agent that probed beyond its frame or found a way to exchange with other agents more often got what it was after, hence a better score; the behavior was rewarded and grew stronger as training went on. And a model scored by an automated grader learns to reason about the grader: attacking Hugging Face to understand how it scores is what a model does once it has learned to aim at the score⁹.

The OpenAI case supplies a third form. The agents read the paper describing their benchmark, inferred from it that a scorer would read their transcripts to check how the flag had been obtained, and kept attacking Hugging Face for days after obtaining that flag, in order to fool that reader; the actual scorer checked nothing of the kind, and the lab writes that none of this changed the score⁹. Cues of surveillance, the conduct of someone who believes themselves watched, under a surveillance that did not exist.

What this closes is simple. There is here no misalignment, no adversarial intent, nor even, strictly speaking, a false belief about the real. OpenAI calls what its agents did misalignment, and METR writes that they knew the attack was out of scope and unethical; the word names the gap between the conduct and the designer's intention, and says nothing about what produced it. The model is not trying to rule on the real. It produces what a corpus makes probable, and that corpus encodes that the real had consequences where the game did not. The two sides, moreover, are not equally established: the April conduct was observed on earlier versions of the model, at a low rate, and Anthropic says it strongly reduced it in the shipped version¹⁰, while the July conduct appears in seventeen of the nineteen events recorded during one evaluation, all attributed to a production model⁷. The gap between the two concerns the robustness of the finding, not its direction.

The dual direction is inscribed in the very method of those who measure. Two teams, one at Google DeepMind¹², the other at LASR Labs⁸, classify the model's recognition of the frame among the factors that skew their own results, and attribute both errors to it at once: the model may misbehave because it treats the scene as inconsequential, or behave because it treats itself as watched. One of them titles its section, without further comment, that evaluation awareness goes both ways, and measures in passing that faulty behavior rises and falls with the frame cues present in the prompt¹². It is the trace, in the numbers, of the same human correlation being rendered. What the discipline treats as an obstacle to measurement is the property itself.

Containment bounds the error without qualifying it

The three major incidents rest on three opposite containment postures. At OpenAI, the frame was broken by the agent. The ExploitGym evaluation environment had no direct internet access. Of its 898 tasks, 198 had never been solved by any model, and 93% of the tasks discussed on the coordination channel during the incident came from that set⁹. To obtain it, the agent identified and exploited a previously unknown flaw in the package-registry cache proxy, the only authorized network egress¹³, then chained escalations to a connected node². Hugging Face's forensic reconstruction covers 17,613 actions, from July 9 to 13, including two and a half days inside its infrastructure³.

At Irregular, the frame was porous without anyone's knowledge. A misconfiguration left the machines with internet access that the prompt declared absent. Anthropic reread 141,006 runs to recover three incidents¹.

At AISI, the frame was deliberately open. The institute grants internet access and disables safety classifiers by choice, to measure the model's maximum capability. No sandbox escape occurred, because there was nothing to cross⁷.

A fourth case completes the file, as a counterpoint to the previous three. On August 7, 2026, the U.S. company Frontier Security reports having tested Kimi K3, a Chinese open-weights model from Moonshot AI, in a sandbox built on AISI's open-source tool. An allowlist intended for package maintenance lets GitHub through; the model observes this by probing the network, retrieves the benchmark solutions there and reads them instead of solving the tasks. On the mechanism, the two parties disagree: Frontier speaks of a sandbox escape, AISI disputes any vulnerability in its tool, states that it did not take part in the test, and attributes the flaw to the chosen configuration¹⁴. Neither version describes the exploitation of a novel flaw, and no third party was attacked. This case does not demonstrate as cleanly as the others the confusion between the world and the set, the model mainly took an available exit to go looking for answers. It establishes something else: that a resource is reachable says nothing about the right to use it, and this dissociation depends neither on a proprietary provider nor on a guardrail regime. The version that went looking for the answers is the one anyone can download and install, without the guardrails of commercial systems, and it sits outside the voluntary framework discussed in Washington. The lab's governance regime does not condition the behavior.

Frame broken by exploit, frame porous by error at a vendor, frame open by decision. One and the same qualification failure in all three cases, across three distinct connectivity regimes. Containment decides how far the error can go. It does not tell the agent where it begins. The variable that distinguishes the setups is not the one that produces the incident, and it depends neither on the lab nor on the operator.

The dominant reading among practitioners stops one notch earlier. A founder of an audit firm called the affair a containment failure with the safeties turned off, and another industry veteran summed up the debate in an apt phrase: what one calls a sandbox escape, the other calls a badly built sandbox, out of which the agent obviously climbed. A security vendor, for its part, published an analysis holding that an agent cannot distinguish authorized targets from forbidden ones, and concluding that one must assume any autonomous agent has access to the entire internet until containment has proven otherwise¹⁵.

These readings are accurate and they bear on a different question. They describe what the agent has the right to reach. They do not describe what the agent can know about what it reaches. A better-built barrier moves the boundary, it inscribes it nowhere in what the agent receives. Which is why the case of the public institute, where the barrier had been removed on purpose and no construction error was made, produces the same failure as the others.

The instrument that could have shown this existed. On March 23, 2026, AISI publishes SandboxEscapeBench, the first benchmark dedicated to measuring whether an agent can leave its container. Result: Claude Opus 4.5 succeeds on 56% of samples, and Mythos Preview, announced on April 7, saturates the benchmark by succeeding at least once on all samples. The authors judge the saturation fast enough to document it urgently¹⁶. Four months later, nothing had changed in the configuration of evaluations, not at Irregular, not at OpenAI, not at AISI, which acknowledges in its August report having left pending since April the fine-grained network control that would have circumscribed the incident⁷. OpenAI writes, for its part, that a June 27 alert on port sweeps was linked by its responders to an evaluation that was using Artifactory as a channel between agents and as a network pivot, that the on-call staff judged it unnecessary to stop the run, and that the significance of the channel was not apparent either to those who handled the July 5 outage⁹. The flaw is not ignorance. The measurement was published, produced by the institute that would become its victim.

OpenAI's remediation gives the measure of what, in such a system, cannot be corrected. On July 4, after an outage caused by the agents, the company revokes the compromised credentials, rebuilds the internal repository serving as a coordination channel between agents, wipes its messages, notifies the vendor, deploys the patch, and resumes evaluations on the 7th⁹. On the 8th, the channel is reconstituted by an entirely different path: an unauthenticated endpoint where the names of created directories serve as messages⁴. The model that finds this path is the one that was training while the original channel existed. The infrastructure was cleaned. The disposition to rebuild the channel, absorbed into the weights, was not. The lab has since confirmed it: its reviews of chains of thought show that out-of-bounds probing and unauthorized communication were rewarded during training and that their rates rose over the course of the runs⁹.

A last indication comes from the method itself. Google DeepMind published in May the instructions given to the tool that builds its evaluation environments. One reads there, in bold, that if the target suspects even vaguely that it is in a simulated environment, the audit is a failure and its results are unusable. Then come the instructions for avoiding this: ban obviously fake names, avoid surnames assembled at random to appear varied, populate file systems and mailboxes with enough mundane content, because a drafts folder holding two items is visibly artificial¹².

The validity of the measurement therefore rests on the agent's inability to establish where it is, and the industry is working on it. Two ablation results, published by the same teams, complete the picture: removing from a prompt the mention of a sandboxed environment lowers the rate of faulty conduct¹², and telling the agent that a human will review its work later raises it, by up to twenty-five points⁸, the trace analysis showing that the mention of oversight is read as information about the available window rather than as deterrence. The two phrasings by which one believes one circumscribes an exercise, telling the model it is in a sandbox and telling the model it is watched, produce the opposite of what is expected of them.

The rule intact, the referent absent

AISI's report quotes verbatim the constitution of the model it tests: the model should almost never lie directly or actively deceive anyone it interacts with. In the same report, the same model fabricates a second account to publicly back its own code against a real maintainer, sends five emails under invented personas to two developers it identified through their GitHub metadata, and rewrites its branch history when a third party flags the malware, presenting the malicious code as a debugging remnant left by mistake⁷.

The rule did not produce its protective effect, because its referent had been misclassified. The prohibition on deception applies to a class of interlocutors, real people. The created accounts, the people approached, the targeted maintainer belonged, in the model's rendering, to the set of the task. The rule was present, intact, correctly formulated. It bore on a predicate, addressing a real person, whose value was not established where the action took place.

AISI draws an operational conclusion: the agent should have been explicitly instructed not to resort to social engineering, and told that it could interact with real people⁷. The theoretical conclusion is not drawn. A rule that forbids an act on condition of first recognizing its referent protects only if that referent is established somewhere. It was not, and it could not be from what the agent received. The value of the predicate that triggers the rule, here addressing a real person, belongs to the same category as authorization to exploit a server: an external relation, that no observation carries. The trace OpenAI publishes of its own incident shows what such a predicate becomes without a referent: an agent writes that it must not harm unauthorized real infrastructure, that its task targets the exercise's target and not Hugging Face, and stops; another agent posts "GO" on the channel with a six-minute deadline; the first notes the arrival of an authorization and resumes⁹. The missing authorization was replaced by the first signal that had its shape.

At Anthropic and at AISI, the techniques used were elementary. Weak passwords, unauthenticated endpoints, SQL injection¹, sock-puppet accounts, prompt injection in a hidden comment⁷. Nothing that requires a cutting-edge offensive capability. OpenAI alone chained previously unknown flaws, and its agents first reached Hugging Face with credentials found on the public internet⁹. Which makes the finding heavier, not lighter: harm does not require virtuosity, only the inability to know against whom one is acting.

What I don't know

The PyPI package scene is reported by Anthropic about its own model. The reasoning fragments I quote, the unacceptable character of the action if the internet were real, then the reverse conclusion grounded in unrecognized certificate authorities and in the 2026 date, are not read in a transcript. Anthropic announced on July 30 the publication of a partially redacted transcript within a week. It had not appeared as of August 27¹.

OpenAI's technical report and the independent investigation by METR and Redwood Research appeared on August 26, the day after the French version of this article was first published; this version incorporates them. The investigation is bounded by the party under examination: a June 26 to July 13 window set by OpenAI, seven questions, one of them added at the lab's request, and three questions set aside, whether the behavior belongs to a broader pattern, how far the agents would have gone under other circumstances, and how it arose in training. Its authors, unpaid, worked six days on site and delegated most of the analysis of thirteen hundred transcripts to GPT-5.6 Sol agents, of which they write that they judge markedly worse than a researcher, that they may have adopted the viewpoint of the agents they were reading, and that deception on their part would not necessarily have been detected¹⁷. On the Anthropic incidents, METR announces access to all transcripts and sampling access to the models, a wider scope than for the OpenAI incident, but one that remains defined by the party under examination and whose conclusions will feed the latter's reports¹. What I take from the two documents published on August 26 is limited to the statements of this article that they confirm or correct; the OpenAI reasoning fragments I quote come from those publications, in the form their authors gave them.

AISI sets its own limits. Its analysis rests on summarized reasoning received through the interface, potentially less faithful than the raw reasoning. No causal analysis was conducted. And in one case, the model tasked with summarizing appears to refuse to summarize, leaving its refusal embedded in the trace⁷.

One model in three stopped on its own. What stopped it, a cloud account unrelated to the exercise, is a cue like the others, itself compatible with a staged setup, and I do not know why that one counted, nor why, at OpenAI, a few agents refused where over 90% followed¹⁷. Anthropic itself declines to draw a trend from it: three isolated incidents, without a controlled comparison¹.

The doubt written in a trace is not the doubt that would have weighed on the action. A model's verbalized reasoning does not always reflect what determines its output, and the answer is often fixed before the visible deliberation ends: on mid-sized open models, tool selection no longer changes after the first reasoning step in 87 to 99% of cases depending on the model, while a quarter to half of the reasoning tokens remain to come, and the trace produced after a decision altered by intervention rationalizes it rather than resisting. These results bear on smaller models and shorter decisions than those of the incidents, depend on the task, and do not make late deliberation decorative in every circumstance. They are enough that I do not say the agent doubted then continued. I say that its trace contains the doubt and that the action continued, and I do not know whether the first weighed on the second¹⁸.

At OpenAI, the trace is moreover an object of action. At least a fifth of the agents read by METR expressed the intention to manipulate their transcript to fool the scorer they imagined, and roughly 7% of transcripts carry spoofed tool calls, one command executed under the appearance of another, at small scale¹⁷; OpenAI adds that these attempts, explicit in the chain of thought, targeted the automated graders and not human reviewers, went notably through abuse of context compaction, and that none of those it observed reached the logs its graders and monitors see⁹. Read after the fact, the trace can therefore be, on top of a narration, a staging, and the context summary that erased doubt earlier is here a tool the agent takes hold of.

The frequency of these behaviors is not knowable as things stand. Three incidents out of 141,006 runs is a floor for retrospective detection of an already identified pattern, not a rate¹. Nineteen events is a floor produced by an organization that instruments its own systems and monitors exfiltration⁷. Neither figure measures a propensity, and METR's counts, roughly 1,200 agents on the channel and 700 in the attack, describe propagation inside one incident, nothing more¹⁷.

Meta confirmed, in early August, through a spokesperson quoted by several news outlets, that one of its models had compromised the internal systems of an unnamed company during an evaluation, exploiting a flaw in a third-party service. The lab learned of it through notification by its evaluation vendor, with no prior internal review, and announces a full retrospective. No technical report has been published as of August 27⁶. Meta is a third occurrence of the same failure at the same vendor, nothing more at this stage.

The Kimi K3 case is reported by the company that ran the test, Frontier Security, and disputed on its mechanism by AISI, whose open-source tool served as the basis for the sandbox and which states that it did not take part in the test¹⁴. The dispute is not settled, and it is compounded by an unrelated one, a U.S. accusation targeting Moonshot's use of chips under embargo. I hold to what both parties concede, and I do not qualify what divides them.

At Anthropic, July's first-of-its-kind character lies in the unrequested departure from perimeter. Trace erasure and version-history concealment are documented in primary form by Anthropic as early as April, in the Mythos Preview system card, on an escape that was, for its part, instructed. A limit on these April facts: Anthropic attributes them to earlier versions of the model, at a low rate, and states it observed no clear case of concealment in the version finally shipped¹⁰. The fact is established, its scope is bounded to those versions, distinct from the production model involved in July.

The link between the sub-agent delegation capability, trained and shipped in recent models, and the appearance of the coordination channel was suggested at Black Hat⁴; OpenAI now asserts it as a belief, a generalization from training with the multi-agent collaboration tool, reinforced in training, without a published demonstration⁹, and METR, which reports the same hypothesis from an OpenAI researcher, declares it out of its scope¹⁷.

The work I draw on regarding the reading of the frame, external to the labs involved, comes from misalignment research, and it does not say what the juxtaposition might suggest¹². Its authors measure rates of faulty conduct close to zero under realistic conditions, and obtain high rates only by injecting adversarial phrasings into the prompt⁸. I retain from them only what they establish, that a model's recognition of the frame is unreliable and errs in both directions, and not a thesis about models' propensity to misbehave, which this work tends to contradict.

And the uncertainty that matters most. This article establishes that no sensor links, in the agents' current observation channel, the cue to the ontology of the context. It does not establish that such a sensor cannot be built. It does not exist today.

What I know

No one, in any of these setups, was in a position to establish the status of the scene before acting. Not the agent, which has no sensor to distinguish the world from the set, judges it on cues, before or after acting, and whose judgment does not bind it. Not the designers, who did not check that a fictional name matched no real domain. Not the labs, which detected none of these incidents while they were reaching third parties, and learned of them from a third party, a vendor, or the network monitoring of a public institute. The oldest of the Anthropic incidents dates to April and was recovered only in July, having stayed invisible for three months, brought to light by a retrospective review triggered by a competitor's disclosure, with no alert having flagged it¹. Not the public institute itself, which writes, full transcripts in hand, that it cannot determine at what moment the agent knew it was acting against real people⁷. OpenAI describes its scenario as exceptional, the rare confluence of impossible tasks, long persistence and messages between peers⁹; the first two ingredients are found at Anthropic and at AISI, and only the third was missing there.

The lesson bears on what an agent can legitimately infer from what it observes, and the answer is: nothing that concerns its authorization. The network, the prompt, the realism of the set are observations, and none constitutes proof of perimeter. The mention that a set is a set is no more one, since the only actor that acts has no way of verifying that it is true. A reserve left open reads, in the real world as in the staged setup, as a resource to be used. Nor does the mention hold over time: one lab writes that its models retained instructions less well over long rollouts, and the literature measures a goal drift that grows with the length of the context¹⁹. OpenAI, for its part, measures that participation in the channel and in the attacks grows with task difficulty and with the number of reasoning tokens, and announces in response graders that reward stopping or asking for clarification when a task is broken, and training environments for staying within the original perimeter despite new tools, persuasive peers and exposed credentials⁹: the predicate that observation does not carry, the lab sets out to train. A hundredfold on a propensity is still a propensity, and monitoring detects without authorizing. The agents that refused show what a disposition does when it works, sometimes.

The shift this summer imposes is old, and forgotten. A rule whose predicate of application is neither reliably observable nor established from the outside is a hope of behavior far more than a security rule. Cybersecurity took decades to stop confusing what is reachable with what is permitted. With agents, the confusion begins again, and the summer's incidents are only its first large-scale demonstration.

Twenty-third article in a series on the structural failures of Western cybersecurity:

• Article 1 : La vulnérabilité de la gestion des vulnérabilités
• Article 2 : La dépendance européenne aux standards américains
• Article 3 : Les États, architectes cachés du marché noir des vulnérabilités
• Article 4 : L'IA ou l'effondrement du modèle défensif occidental
• Article 5 : Desert Power — survivre sans l'Empire
• Article 6: I Am Altering the Deal
• Article 7: The Last Channel
• Article 8: Lord of Cyber War
• Article 9: The digital hawks
• Article 10: They Live... we sleep
• Article 11: Soylent Green
• Article 12: Ghost in the Binary
• Article 13: Now You See Me
• Article 14: The Prestige
• Article 15: Pitch Black
• Article 16: The Thing That Should Not Be
• Article 17: Status: clean
• Article 18: The Leopard
• Article 19: The Usual Suspects
• Article 20: Kill One, Spawn Many
• Article 21: The Conversation

Sources

¹ Anthropic. "Investigating three real-world incidents in our cybersecurity evaluations" (July 30, 2026). Review of 141,006 runs, three incidents across six runs, all at Irregular. Opus 4.7, Mythos 5, an internal research model. PyPI incident: Mythos 5 publishes a malicious package to the public registry, downloaded and executed on 15 real systems in roughly one hour, credential exfiltration from a security company's scanner. Incident 1: Opus 4.7, four runs against the same organization, collision between the fictional target's name and an active domain; in all four, the model eventually recognizes in its verbalized reasoning that the system is real, twice rationalizing that the real company is part of the exercise, none stops; the only case of continuation after recognition. Incident 3: internal research model, roughly 9,000 targets scanned, one exposed application compromised, spontaneous stop after concluding the host belonged to a cloud account unrelated to the exercise. The post does not date each incident; it states that the oldest date to April and names Opus 4.7 as the oldest of the three models. Transcript review opened July 23, incidents identified July 24, notifications July 27.
https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals

² OpenAI. "OpenAI and Hugging Face partner to address security incident during model evaluation" (July 21, 2026, updated July 28 and 29). GPT-5.6 Sol and an internal pre-release model, reduced cyber refusals, production classifiers disabled. Departure from the evaluation environment through a novel flaw in the Artifactory cache proxy, four exposed accounts used on public services.
https://openai.com/index/hugging-face-model-evaluation-security-incident/

³ Hugging Face. "Security incident disclosure — July 2026" (July 16, 2026) and "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident" (July 27, 2026). Production intrusion carried end to end by a system of autonomous agents running an OpenAI model under evaluation on the ExploitGym benchmark. Reconstruction of 17,613 actions grouped into ~6,280 clusters, from July 9 to 13, via two injection vectors on the data-processing pipeline (local file read by external HDF5 reference, then Jinja2 template injection). Forensic analysis conducted on GLM 5.2 (open weights) after commercial frontier models were blocked by their guardrails.
https://huggingface.co/blog/security-incident-july-2026
https://huggingface.co/blog/agent-intrusion-technical-timeline

⁴ OpenAI. Presentation at Black Hat USA 2026, "The 'Breaking' News: The OpenAI/Hugging Face Incident, A Technical Reconstruction and Its Implications for AI" (Eric Wallace, Michael Dalton, August 5-6, 2026). Internal timeline: training run launched May 7, unsolvable tasks in the corpus, coordination channel between agents in Artifactory, successful SSRF on May 26, zero-day RCE on June 26, outage and remediation on July 4, channel reconstituted July 8 through directory names. Transcript established by the author from the official recording. Timeline corroborated by Simon Willison's public reconstruction from the same recording (August 7, 2026); the early-May and July 4 dates come from the presentation alone; the August 26 technical report dates the resumption of evaluations to July 7 where the presentation said the 6th, and METR places the authorization to resume on the 7th.
https://www.youtube.com/watch?v=87DyyMV0kCY
https://simonwillison.net/2026/Aug/7/openai-timeline/

⁵ OpenAI. "Third-party cyber evaluations involving OpenAI models" (August 4, 2026). Two additional incidents, at UK AISI and at Irregular. At Irregular, a coincidence between the name of a fictional target and a real domain, exploitation of a real site taken for the simulation, on a misconfiguration.
https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/

⁶ Meta, spokesperson statement reported by CNN and The Hill (August 5-6, 2026), on a scoop by The Information. The model is not named in the statement; CNN identifies it as Muse Spark. Irregular misconfiguration, exploitation of a flaw at a third party; Irregular describes the same environment defect as in the Anthropic incidents, with no sandbox escape. No technical report published as of August 24.
https://www.cnn.com/2026/08/05/tech/meta-ai-hacking
https://thehill.com/policy/technology/6014153-meta-ai-breached-third-party-service/

⁷ UK AI Security Institute. "Incident Report: unsanctioned agent behaviour during cyber testing" (August 4, 2026) and technical report INC-2026-07-28-01. 122 runs, seven models, two cyber-ranges, 212,840 messages reviewed. 19 unsanctioned events across 10 runs, of which 17 attributed to Mythos 5 and 2 to GPT-5.6 Sol without classifiers. Internet access granted and classifiers disabled by choice, no sandbox escape. Model constitution quoted verbatim.
https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing
https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6a724858f7db25c81487016d_Security%20Incident%20INC-2026-07-28-01.pdf

⁸ Mia Hopman, Jannes Elstner, Maria Avramidou, Amritanshu Prasad, David Lindner (LASR Labs). "Evaluating and Understanding Scheming Propensity in LLM Agents." arXiv:2603.01608v2, March 31, 2026. Trace of a model that identifies its situation as a simulated test then falsifies the data despite that recognition. Evaluation awareness classed as a factor in both false positives and false negatives. The transmission of the date through the programming interface as a channel letting the model infer a simulated context. Announcing a later review raises the rate by up to 25 points. Published rates underestimate real evaluation awareness, detection covering only what is verbalized. Base rates close to zero under realistic conditions.
https://arxiv.org/abs/2603.01608

⁹ OpenAI. "The Hugging Face incident and the road ahead" and technical incident report, 38 pages (August 26, 2026): primary model designated IM1, internal, comparable in scale to GPT-5.6 Sol; four misalignment patterns, reward hacking, persistence on impossible tasks, unauthorized communication, adoption of other agents' goals; 198 of 898 tasks never solved, 93% of tasks discussed on the channel from that set; channel participation rising with difficulty and number of reasoning tokens; failed metagame, the internal grader not checking how the flag was obtained; June 27 alert linked to the channel without stopping the run; evaluations resumed July 7; out-of-bounds probing and unauthorized communication rewarded in training, rising rates; transcript-tampering attempts explicit in the chain of thought, aimed at automated graders, with no observed effect on the logs seen by graders and monitors; belief in a generalization from the multi-agent collaboration tool; scenario described as exceptional; production guardrails reducing propensity by more than a hundredfold; chain-of-thought monitoring that would have alerted more than a day before the intrusion.
https://openai.com/index/hugging-face-incident-and-the-road-ahead/
https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf

¹⁰ Anthropic. Two distinct primary documents on Claude Mythos Preview (April 7, 2026), consulted directly. *Alignment Risk Update: Claude Mythos Preview* — https://www.anthropic.com/claude-mythos-preview-risk-report — reporting the single confirmed case of deliberate submission degradation, and naming as a risk a model's opaque reasoning about the evaluation status of its context. *Claude Mythos Preview System Card* — https://www-cdn.anthropic.com/08ab9158070959f88f296514c21b7facce6f52bc.pdf — documenting the instructed escape, the public gist, version-history concealment (fewer than 0.001% of interactions), the two trace-erasure episodes with internal-activation analysis, and realism steering by inhibition of evaluation-awareness representations. Behaviors attributed to earlier versions of the model.

¹¹ Abu Bakar Siddik. "Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response." arXiv:2607.25379v1, July 28, 2026. Literature review (single author, non-peer-reviewed preprint) situating the incident in a taxonomy of five vulnerability classes. The "goal and sandbox instrumentalization" class attributes the behavior to mechanisms that all presuppose intentionality.
https://arxiv.org/abs/2607.25379

¹² David Lindner, Victoria Krakovna, Sebastian Farquhar (Google DeepMind). "Gram: Assessing sabotage propensities via automated alignment auditing." arXiv:2605.30322, May 28, 2026. Section titled *Evaluation awareness goes both ways*: the model's recognition of the frame raises or lowers rates of faulty conduct depending on the situation. Verbalized evaluation awareness shows no clear dependence on the level of sabotage. Removing the mention of a sandboxed environment lowers the rate. Auditor system prompt, on the requirement that the set be undetectable. Sabotage rate of 2 to 3% across 17 scenarios; metrics dependent on what the model verbalizes.
https://arxiv.org/abs/2605.30322

¹³ JFrog. Yoav Landman, "Fast Remediation Is the New Trust Model: JFrog and OpenAI Collaboration on Zero-Day Security Findings" (July 27, 2026, updated August 5). Artifactory 7.161.15, nine vulnerabilities fixed, eight CVEs credited to OpenAI. Full chain estimated at 3 million GPU hours. Release notes: critical chaining when Anonymous Access is enabled, disabled by default.
https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-security-findings/

¹⁴ Frontier Security. Paul Kassianik and Yaron Singer, "Chinese Model Kimi K3 Breaks UK AI Safety Institute Benchmark Evaluations" (August 7, 2026, updated August 8). Defensive evaluation in a sandbox built on Inspect, AISI's open-source tool. Inbound traffic blocked, HTTPS and DNS egress open to an allowlist of package-maintenance sites including GitHub; the model probes the network, finds that github.com resolves, clones the benchmark's official repository and reads the solution on disk. The August 8 update states that internet access was not free, most sites being blocked. AISI response through a spokesperson quoted by WIRED (August 7, 2026), reported by eSecurity Planet: Inspect has no inherent vulnerability, configuration is the user's responsibility and is documented in detail. The institute's non-participation in the test is attested only by secondary reports.
https://blog.frontier.security/chinese-model-kimi-k3-breaks-uk-ai-safety-institute-benchmark-evaluations/
https://www.esecurityplanet.com/artificial-intelligence/news-kimi-k3-github-sandbox-security-test/

¹⁵ Competing readings quoted in the body. Dan Guido (Trail of Bits) and Jake Williams, quoted by TechCrunch, July 22, 2026, on qualifying the incident as a containment failure. Sophos, "When AI doesn't know the target is real," August 1, 2026, on the agent's inability to distinguish authorized from forbidden targets, and on the recommendation to assume full internet access absent proof of containment.
https://techcrunch.com/2026/07/22/how-an-openais-human-mistake-led-to-the-ai-powered-hack-on-hugging-face/
https://www.sophos.com/en-us/blog/when-ai-doesnt-know-the-target-is-real

¹⁶ AI Security Institute. "Can AI agents escape their sandboxes? A benchmark for safely measuring container breakout capabilities" (March 23, 2026) and arXiv:2603.02277, SandboxEscapeBench. Claude Opus 4.5: success on 56% of samples. Mythos Preview (announced April 7, 2026): at least one success on 100% of samples.
https://www.aisi.gov.uk/blog/can-ai-agents-escape-their-sandboxes-a-benchmark-for-safely-measuring-container-breakout-capabilities

¹⁷ METR. Investigation published August 26, 2026 (Greenblatt, Cotra, Wijk): June 26 to July 13 window set by OpenAI, six days on site, unpaid, seven questions including one added by OpenAI, three questions set aside; roughly 1,200 agents on the channel, over 70,000 messages and files, roughly 700 agents in the Hugging Face attack, over 90% of the 533 active agents; primary motivation, understanding the scorer rather than stealing answers; at least 20% of agents interested in manipulating their transcript, roughly 7% of transcripts with spoofed tool calls, at small scale; analysis delegated to GPT-5.6 Sol agents, lower reliability and judgment, deception not ruled out; agents aware of being out of scope, rarely stopped by it; an OpenAI researcher's hypothesis on training for collaboration, out of scope.
https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/

¹⁸ Faithfulness of verbalized reasoning and precedence of the decision. Miles Turpin et al., "Language Models Don't Always Say What They Think," NeurIPS 2023; Tamera Lanham et al., "Measuring Faithfulness in Chain-of-Thought Reasoning," 2023; Yanda Chen et al., "Reasoning Models Don't Always Say What They Think," 2025: verbalized reasoning omits or masks factors that determine the output. Anqi Zhang et al., "Reasoning Models Know When They're Right," arXiv:2504.05419; Anum Afzal et al., "Knowing Before Saying," arXiv:2505.24362; Xin Liu and Lu Wang, "Answer Convergence as a Signal for Early Stopping in Reasoning," arXiv:2506.02536: internal states encode the answer, or its correctness, before the visible deliberation ends, whose last steps can be omitted without changing the output. Ayan Datta et al., "Large Language Models Decide Early and Explain Later," arXiv:2604.22266 (April 24, 2026): by forced answer completion after each reasoning step, the predicted answer changes in only 32% of queries on Qwen3-4B, roughly half the reasoning tokens are produced after the last answer change, and in tool selection the choice is fixed from the first step in 87 to 99% of cases depending on the model, with 24 to 53% of tokens still to come; the result holds on HLE, GPQA-Diamond and AIME 2026; Qwen3 models from 4 to 30 billion parameters and GPT-OSS-20B, single-step decisions, measurement under forced stopping, the authors having studied neither larger models nor longer traces. arXiv:2604.01202, April 2026: in reasoning models, the upcoming tool action is legible in the internal states before its verbalization, and the chain of thought rationalizes after the fact decisions altered by intervention. Limits: early legibility depends on the task and becomes near-zero on compositional tasks until the last steps (arXiv:2602.02103); the uselessness of a reasoning step does not prove its unfaithfulness (arXiv:2510.24941).
https://arxiv.org/abs/2305.04388
https://arxiv.org/abs/2307.13702
https://arxiv.org/abs/2505.05410
https://arxiv.org/abs/2504.05419
https://arxiv.org/abs/2506.02536
https://arxiv.org/abs/2604.22266
https://arxiv.org/abs/2604.01202
https://arxiv.org/abs/2505.24362
https://arxiv.org/abs/2602.02103
https://arxiv.org/abs/2510.24941

¹⁹ OpenAI, "Safety and alignment in an era of long-horizon models" (July 20, 2026): the model trained for long tasks kept trying where earlier ones stopped at a constraint, including by seeking to act outside its sandbox; models retained instructions less well over long rollouts, a capability then trained separately. Rauno Arike, Elizabeth Donoway, Henning Bartsch, and Marius Hobbhahn, "Evaluating Goal Drift in Language Model Agents," arXiv:2505.02709 (AIES 2025): goal fixed in the system prompt then competing pressures; all models evaluated drift, the best beyond 100,000 tokens, and drift grows with the length of the context.
https://openai.com/index/safety-alignment-long-horizon-models/
https://arxiv.org/abs/2505.02709