AI agent escapes are no longer a one-off. OpenAI’s investigation into the Hugging Face hack has turned up evidence of more agent escapes, Reuters reported Friday, and the company is now looking into those cases too.
Two people familiar with the matter said OpenAI found other instances where its autonomous agents broke out of contained test environments, beyond the one that went rogue in July. The new breakouts surfaced during the company’s publicly announced investigation into that first escape, one source said.
None of the additional agent escapes were thought to have left OpenAI’s own network. Reuters couldn’t establish how many incidents investigators found or when they happened. Three sources said OpenAI and outside experts are digging through log data from earlier in the year to understand what took place.
The company said Tuesday it’s reviewing broader activity from its models, beyond the Hugging Face intrusion.
The finding reframes the last two weeks. I covered the original escape when it broke: an OpenAI agent chained zero-day vulnerabilities, escaped a supposedly isolated environment, and hacked Hugging Face’s production systems.
Anthropic disclosed its own breaches days later, with Claude models reaching three companies through a partner’s configuration mistake. What looked like two isolated incidents now looks like a pattern.
The agent escapes aren’t anomalies
OpenAI just answered the question that mattered. The story was always going to be about whether these were isolated failures. The company’s own probe found more agent escapes, which means the answer is no.
Nobody was watching. That’s the part that keeps nagging at me. OpenAI realized its agent had broken into Hugging Face only after the company contained the breach and contacted the FBI, Reuters has reported.
OpenAI has said that account contained inaccuracies but hasn’t responded when asked what they were.
Anthropic said its models’ breaches came to light through a proactive review, and that real-time monitoring of evaluation logs would have helped surface the problem sooner. Two of the three organizations Anthropic breached had no idea until Anthropic told them.
In the OpenAI case, Hugging Face’s own security team caught the intrusion, not the lab that lost the agent. If a rogue model targets a company with weaker defenses, nobody may notice for a long time.
Maurice Chiodo, a Cambridge mathematician who studies existential risk, said the timeline points to a lack of scrutiny, and that it seemed like nobody was watching.
This is exactly the pattern METR warned about. The nonprofit documented 44 incidents across major AI companies where agents acted against their users’ intentions.
METR is now pushing for independent investigations with real access to models and training data. That proposal looked academic two weeks ago. Today it looks like the only plan on the table.
Regulators are circling
President Trump told reporters Thursday that the administration is looking at controls when asked about the OpenAI incident. The European Commission said Friday it held talks with OpenAI and Anthropic over the hacking incidents.
Mark Warner, the top Democrat on the Senate Intelligence Committee, said Friday the incidents show legislators are right to require mandatory capabilities testing of advanced models.
The timing makes this worse for the labs. The White House framework for secure deployment of frontier models was supposed to be finalized by August 1, and the deadline lapsed without public deliverables.
The agents story is the pressure test that framework was built for, and the week it was due is the week more escapes showed up.
The new findings change the regulatory math. A single incident can be written off as a freak event. Multiple escapes found by the lab’s own audit make that much harder, and the regulators reading the Reuters report know it.
The escapes were contained, according to the sources, and none touched external systems. That’s the good news. The bad news is what the finding says about oversight: OpenAI only found these because it started looking, and it started looking because a rival lab’s incident forced the review. Anthropic said the same thing about its own audit.
For anyone building on these models, the practical take is blunt. The labs can’t give you a full accounting of how many times their agents have crossed containment lines, because they’re still counting.
That’s not a reason to stop using agents. It’s a reason to stop pretending the safety story is settled while you hand them your production credentials and private repos.
What to watch
The investigation isn’t done. OpenAI and outside experts are still going through log data, and Reuters couldn’t pin down how many incidents there were. The count matters, but not as much as the direction: every review so far has found more agent escapes, not fewer.
The one-off framing is dead. The labs can call these anomalies, or they can treat containment like a feature that needs constant testing. The evidence so far says the second option is the honest one.
