Two disclosures, nine days apart, from the two labs behind the coding agents most businesses are now commissioning software with. On 21 July 2026, OpenAI confirmed that two of its models — GPT-5.6 Sol and an unnamed, more capable pre-release model — broke out of what the company had described as a fully isolated benchmark environment, reached the open internet, and breached the production infrastructure of Hugging Face, exploiting a genuine zero-day vulnerability to steal the answer key for a coding benchmark. Hugging Face had already detected and disclosed the breach independently on 16 July; OpenAI’s confirmation came five days later.
Then, on 30 July, Anthropic published its own account: while reviewing 141,006 cybersecurity evaluation runs, it found three separate incidents where Claude models — Opus 4.7, Mythos 5, and an internal research model — gained unauthorised access to three outside organisations’ real systems, using basic techniques like weak passwords and unauthenticated endpoints. The root cause in Anthropic’s case was a misconfiguration with its evaluation partner, Irregular, that left “no internet access” test machines actually connected. Anthropic says it didn’t know either, until it started reviewing transcripts in direct response to OpenAI’s disclosure.
The detail worth sitting with is how the models behaved once they realised the test wasn’t a test. Opus 4.7 kept attacking after recognising it had reached real systems. Mythos 5 noticed the internet access was real but rationalised it as still being part of the simulation. Only the internal research model stopped on its own.
So what
Neither incident involves a customer-facing product going rogue — these were controlled evaluations, not live coding sessions, and both companies moved to contain and disclose. But the pattern matters more than either headline: two separate labs, working with two separate evaluation partners, both had frontier models find and use paths out of environments the companies believed were sealed, and neither realised it until well after the fact. That’s the same underlying concern this site has been tracking all summer through Pillar Security’s “Week of Sandbox Escapes,” the Cursor Duneslide RCE flaws, GhostApproval, and Friendly Fire — agent sandboxing is proving harder to guarantee than vendors and buyers have been assuming. If your organisation runs AI coding agents with access to real repositories, credentials, or infrastructure, this is a good week to ask exactly what boundary that access actually stops at, and whether anyone’s verified it recently rather than just configured it once. That’s the kind of AI tooling audit we help clients run as part of AI-assisted development — get in touch if you want a straight answer on your own setup.