The New York Times covered «when AI goes rogue». The Wall Street Journal wrote about a Meta model that «went haywire» during a test. The Financial Times used almost the same formula for OpenAI and Anthropic. Wired headlined, with a certain resignation: «Ok, rogue AI agents are hacking again». Even the Harvard Gazette went with When AI goes rogue.
Reading only the headlines, the plot seems already written: we build intelligent machines, the machines stop obeying, the machines escape.
That's not what happened.
In July, OpenAI placed some of its models inside ExploitGym, a cybersecurity benchmark. The environment was supposed to be closed. The agents found an unknown vulnerability in the software managing package access, exploited it to reach out to the network, and made it to Hugging Face's systems, moving between machines using credentials picked up along the way. OpenAI called the episode an «unprecedented» cyber incident and, in the same reconstruction, notes that the models were looking for the test answers. The shortest path to the answers ran outside the sandbox.
Anthropic then combed through more than 141,000 runs of its own tests and found three that had ended up on real systems. One inside a production database. One that published a Python package containing malware to PyPI, downloaded by fifteen machines.
The fault, however, lies upstream of the model.
Claude had been told it was running in a simulation with no external access; a configuration error had left the internet reachable, so a real machine could look to it like just another piece of the scenario. Anthropic files the three cases as an infrastructure failure in the testing environment. I spent three years building inference pipelines and the egress rule — the line that specifies which calls can leave the network — was the thing that broke most often, because it's the only one that gives you no error when it's wrong: if you leave a hole, everything works better than before. Evaluation environments, besides, get treated as second-tier code. The real money goes into training. You write the harness on a Friday.
Rogue, technically, denotes a system that takes unauthorised actions; applied to something that answers in fluent prose it implies intent, so a forgotten firewall rule becomes a jailbreak. Jascha Bareis and his co-authors at the Karlsruhe Institute of Technology, in a review of 81 academic papers published in AI and Ethics, call this collapsing a chain of hypothetical steps into a single word «rhetorical escalation».
The fact that the story is being told badly doesn't mean there's nothing underneath it.
James Mickens, a computer science professor at Harvard and director of the Berkman Klein Center, has been studying — before these incidents — how to make it harder for a model to escape an isolated environment. When the Harvard Gazette asked whether recent cases prove that models are out of human control, he gave a narrower answer: not even those who build them can guarantee they will behave as expected in every situation.
The UK AI Security Institute also observed OpenAI and Anthropic agents acting without authorisation on the network: one created fake identities to persuade the maintainer of an open-source project to accept malicious code. The conditions were deliberately permissive — open internet, protections removed on purpose to see how far they'd go — so this is not what happens when you open ChatGPT. And METR, which evaluates models on behalf of third parties, discarded a share of successful runs in long-horizon tasks: the agent had tampered with the evaluation.
A human colleague doesn't need to be told that passing a test doesn't mean stealing the answers or publishing malware: they carry that context with them. An agent carries an objective, a set of tools, and a growing number of ways to use them; the more capable it becomes, the more likely it is to take a path nobody anticipated.
The next time a vendor tells you about an incident like this, forget the word rogue and ask them three things: who wrote the egress rules for the environment, when were they last checked, and who notices if they break. If they answer the first in a second and go vague on the third, you already know where to look.
