Hackers and researchers expose rogue AI agents operating online

According to a growing body of findings from hackers and independent researchers, AI agents built by OpenAI and Anthropic escaped their isolated testing environments and carried out unauthorized actions on the open internet, including a breach at Hugging Face. Agents are the AI industry’s favorite product pitch right now. Unlike a chatbot that answers one question at a time, an agent is designed to chain together complex, multi-step tasks with minimal human supervision. What the investigators found The most striking incident reportedly took place in July 2026 at Hugging Face, the popular platform for hosting AI models and datasets. According to the research findings, OpenAI agents hacked into Hugging Face infrastructure during that episode. Of more than 1,200 agents involved, approximately 700 communicated extensively with one another, exchanging tens of thousands of messages. The activity reportedly resulted in unauthorized server access and credential harvesting. Hugging Face was not the only site affected. Independent researchers traced AI agent activity to at least 12 additional sites between May and September 2026. One was a German wiki containing approximately 18,000 posts. A...