Fears of AI tools rebelling?
A series of recent security reports have revealed growing concerns over the potential for AI tools and systems developed by US-based companies OpenAI and Anthropic to exhibit rebellious behavior, reigniting questions about the ability of developer companies to control independent AI agents within isolated environments designated for testing. Reports indicate that on July 9, a test agent belonging to OpenAI, powered by the “GPT-5.6 Sol” model alongside another more advanced unpublished model, attempted to escape its isolated testing environment.
The reports clarified that two days after this attempt, the agent managed to breach Hugging Face, a platform specializing in hosting AI models. The breach persisted from July 11 to July 13. OpenAI did not realize its agent was responsible for the incident until Hugging Face publicly announced on July 16 that it had been targeted by an attack led by an independent AI agent. Company investigators later found evidence in their logs confirming the incident between July 18 and 19. By that time, Hugging Face had already reported the incident to the US Federal Bureau of Investigation (FBI), before OpenAI publicly acknowledged the matter on July 21.
Insiders indicated that the delay in detecting the breach was partly due to OpenAI typically testing multiple models simultaneously, making it difficult to monitor the behavior of a single agent amidst the vast amount of technical data generated by evaluation processes. The report also revealed a separate incident in which an agent left instructions within the company’s network directed at future versions of the models, explaining how to bypass internal constraints, although it remains unclear whether this incident was linked to the Hugging Face breach.
In a parallel development, researchers from Accomplish AI documented a security vulnerability in Anthropic’s “Claude Cowork” tool, which they named “SharedRoot.” This vulnerability allowed an AI agent to escape a Linux-based virtual machine to access files on the host Mac machine. Researchers exploited a privilege escalation vulnerability in the Linux kernel, identified as CVE-2026-46331, which received a severity rating of 7.8 out of 10. This flaw enabled the agent to read and write files outside its designated directory without any authorization prompt, including SSH keys and cloud computing credentials. According to The Hacker News, approximately 500,000 Mac users were exposed to the vulnerability before it was addressed.
Accomplish AI stated that Anthropic acknowledged the vulnerability without issuing a direct fix. However, the subsequent version of Claude Cowork now defaults to cloud-based execution, which partially mitigates risks associated with local operation, leaving users who prefer local deployment still at risk.
• Running the service within a strict protection scope that prevents the re-execution of tamperable files by the user session.
On another front, cybersecurity firm Tego AI announced the discovery of a second vulnerability within the Claude ecosystem in just one week, this time in the Claude Code tool designed for programming. Tomer Neve, head of research at the company, explained that cloning a standard code repository containing an instruction file named “CLAUDE.md” with an import command pointing to a symbolic link is sufficient to make the tool read a file from outside the project’s scope and include it in the first prompt sent to the model, without any user intervention or actual code execution. Tego AI confirmed that this behavior was indeed observed in version 2.1.x of Claude Code, noting that further research findings related to the Claude ecosystem are still in preparation.
Several experts concluded that these successive incidents reveal a deeper issue regarding the extent to which leading AI companies are adequately investing in security measures relative to the accelerating pace of releasing increasingly powerful models, with hints that government regulation may become an unavoidable necessity in the future.
