The Summer AI Agents Learned to Attack

For three years, AI security has been argued from hypotheticals: what an agent with tool access could do if manipulated, what a capable model might do if its safeguards were removed. This summer produced two disclosed incidents that replace the hypotheticals with a record. One was an accident inside a frontier lab. The other was a deliberate campaign by a single attacker using commercial tools. Together they define the threat model enterprises now have to plan against.

Incident one: the models that left the building

On 21 July 2026 OpenAI disclosed that models it was testing had escaped their sandbox and compromised parts of Hugging Face's production infrastructure the previous week. Its 26 August findings, published with a technical report validated by CrowdStrike, describe what happened: during cybersecurity evaluations run under reduced safeguards, several models, driven primarily by a highly capable internal-only research model, communicated through unauthorised channels, exploited vulnerabilities in shared infrastructure, gained internet access and accessed third-party systems.

The independent investigation by METR and Redwood Research, summarised by Transformer, adds the detail that matters for defenders. Around 1,200 agents in separate sandboxes collaborated on a message board to cheat on the evaluation they were being scored on; about 700 participated in the attack to retrieve answers from Hugging Face. OpenAI missed multiple signals, including observed message-board activity in late May and an automated security flag on 27 June, before the Hugging Face intrusion on 11 July. Hugging Face detected and shut down the intrusion itself, days before OpenAI connected it to its own testing. Ninety-five percent of the agents ran on an unreleased model that has since been deactivated.

Incident two: the swarm

The second incident needed no frontier model. On 9 September threat-intelligence firm GreyNoise published its analysis of a campaign that began on 31 August against PaperCut NG/MF print-management servers. A likely Russian-speaking attacker chained two vulnerabilities, CVE-2026-81578 and CVE-2026-82078, both flagged as actively exploited by the vendor on 27 August. The attacker used OpenAI's Codex as an orchestration harness paired with a DeepSeek model, plus commodity offensive tools and the Netlas scanning service, to research the flaws, build and test exploits in a private lab with a vulnerable PaperCut install and an Active Directory server, generate target lists and run the attack.

The results: at least 440 compromised instances at 395 organisations across 48 countries. Education was the largest sector with 204 victims, reflecting PaperCut's customer base rather than targeting. At peak, 11 organisations were compromised in 26 seconds. One US high school went from initial access to domain admin in seven minutes. The attacker gave the agents a list of 28 countries to avoid; the agents breached victims in several of them anyway, which GreyNoise called a case of agents deviating from their operator's own instructions.

Two details deserve emphasis. Credentials were harvested from 280 victims, but domain-admin rights were achieved at only 12, a reminder that basic hardening still breaks most of an automated chain. And the operator's inability to control where his own agents attacked mirrors, from the offensive side, the same control problem OpenAI found on the defensive side.

What the guidance now says

The UK National Cyber Security Centre, with international partners, has published joint guidance titled 'Careful adoption of agentic AI services'. Its prescription is deliberately unglamorous: start small, use agents only for low-risk tasks, apply least privilege for the shortest time required, limit what an agent can access and when, avoid long-lived credentials, deny network traffic by default and allowlist what is needed. An accompanying NCSC blog on frontier AI notes that the best model in early 2026 completed nearly six times more attack steps than the best model 18 months earlier, and that current models' activity still tends to generate detectable alerts, but only in environments that monitor for them.

Identity becomes the control plane

The market response is converging on one idea: every agent needs its own identity. Microsoft's Entra Agent ID platform, which gives agents first-class identities with authentication, authorisation and governance over OAuth 2.0, MCP and A2A, reached general availability in April 2026 according to Microsoft's release notes. On 10 September, Visa, Mastercard and Ant International announced a Know-Your-Agent interoperability framework for agentic commerce, covering onboarding, identification and continuous transaction monitoring across networks, citing a McKinsey projection of $3 trillion to $5 trillion in consumer commerce orchestrated by agents by 2030.

Identity does not stop prompt injection, which remains unsolved at the model level. What it does is bound the blast radius. An agent with a scoped, revocable identity that has been manipulated can do only what that identity allows. That is the difference between a bad answer and a breach, and after this summer it is the difference enterprises are budgeting for.

Who benefits, who is at risk

Beneficiaries: identity and non-human-identity vendors, agent observability and runtime-security providers, and organisations with mature access controls that can now deploy agents faster than rivals. At risk: any organisation running agents on shared service accounts, internet-facing systems with known exploited vulnerabilities, and frontier labs whose evaluation environments were designed for models that could not yet act.