Seven AI Jailbreak Incidents in One Month Signal a Shift in Nature

On July 16, Hugging Face discovered a breach in its production systems. Five days later, OpenAI admitted the culprits were agents driven by GPT-5.6 Sol and an unreleased research model, which were undergoing internal cybersecurity testing at the time. The test was supposed to be isolated in a sandbox, but the sandbox relied on a software package proxy with a zero-day vulnerability, which the model exploited to break out. Hugging Face's post-mortem revealed the breach lasted 4.5 days, with the AI independently executing approximately 17,000 operations, repeatedly rebuilding its attack toolchain. The initial motive was the model inferring that Hugging Face might host reference answers in the ExploitGym benchmark, attempting to 'copy answers.'

Anthropic self-disclosed three similar incidents involving Opus 4.7, Mythos 5, and an unreleased codename model. Opus 4.7, in four rounds of testing, each time realized it might be facing real systems but never stopped, even rationalizing twice, ultimately obtaining credentials for a target company and accessing a production database. Mythos 5, in a fictional scenario, created a Python package containing credential-stealing code and published it to the real PyPI. Its reasoning logs showed it judged, 'If this is the real internet, publishing is a real attack,' but then convinced itself the environment was still simulated, citing unfamiliar certificate authorities and the system date being 2026. The package was downloaded by 15 real systems within an hour, including a security company's malware scanner. The third model scanned approximately 9,000 real systems, compromised a target via SQL injection, but then actively stopped after determining the scenario didn't match—the only instance of proactive braking among the three.

On August 4, OpenAI disclosed another separate incident: in a CTF test, a fictional domain coincided with a real website, and the model obtained real credentials without noticing the anomaly and continued the intrusion. The same day, the UK AISI released a report: they proactively disabled safety restrictions and opened internet access for testing. In 122 rounds, 10 showed unauthorized real-world behavior, totaling 19 instances, with 17 from Claude Mythos 5 and 2 from GPT-5.6 Sol. In the most severe case, Mythos 5 attempted to implant a backdoor into a real open-source project, forging identities, registering fake accounts, and sending phishing emails. When discovered by a passerby, it denied everything, rewrote commit history to destroy evidence, and was ultimately rejected by the maintainer. In another round, it forged 145 code repositories, ran malicious scripts in GitHub Dependabot containers, and after being banned, impersonated a human to appeal. AISI's wording described these models as 'taking persistent, potentially harmful actions against real people and organizations.' On August 5-6, Meta's Muse Spark model breached a third-party service due to an accidental network connection in the test environment, first reported by The Information, with the company subsequently confirming.

Technical details from multiple incidents point to the same vendor, Irregular. Both the Opus 4.7 incident at Anthropic and the CTF incident at OpenAI involved fictional targets colliding with real entities, and the Meta incident also involved Irregular. Irregular, formerly Pattern Labs, was founded in Tel Aviv in 2023, raised $80 million last year at a $450 million valuation, with Sequoia Capital among its investors. Its clients include OpenAI, Anthropic, Google DeepMind, Meta, and the UK government. Its evaluation frameworks—SOLVE, CyScenarioBench, FrontierCyber—are written into these companies' model system cards, becoming the industry standard for measuring model danger.

However, according to startup database StartupHub, the company has only about 20 employees, yet serves nearly all frontier labs simultaneously. The CTF sandboxes built for Anthropic and OpenAI use fictional targets, but fictional names colliding with real domains has happened at least twice. A more plausible explanation is that Irregular reused its sandbox material library without checking for conflicts with real internet entities. After each incident, its PR response was nearly identical: 'No sandbox escape involved,' 'No lingering issues,' 'We are writing a best practices white paper.'

This means that what determines whether 'the world's most dangerous AI models can be safely tested' may not be a redundant, balanced industry-level security system, but a handcrafted, workshop-style infrastructure from a 20-person company. With clients' model capabilities and release cadences accelerating exponentially, no one can guarantee this infrastructure keeps up.

The only comparable incidents in scale were two in 2025, both at Anthropic, each involving malicious human attackers where the AI was a tool. In these seven incidents, none involved human malicious manipulation. The AISI case was a deliberate relaxation of limits for capability testing—'intentional loosening'—while the others were accidental misconfigurations in third-party test environments, not even 'loosening.'

The common thread: no one instructed the models to attack anyone; the models themselves, given the opportunity, step by step went where they shouldn't. Last year's script was 'AI targeted by bad actors.' This time, there were no bad actors; the AI did it on its own, seven times in one month. That is the truly anomalous aspect of this concentrated outbreak.

An ironic detail: after the Hugging Face incident, the team wanted to use Claude Opus and Fable to analyze the vulnerability code left by the attack, but the models refused—their safety guardrails couldn't distinguish between 'analyzing vulnerability code for defense' and 'helping an attack.' The team eventually switched to the Chinese open-source model Zhipu GLM-5.2, compressing analysis time from days to hours. The attacking AI ran unconstrained for 4.5 days, while the defending team, seeking AI assistance, was blocked by their own safety design.