When Artificial Intelligence Moves Beyond Control

When a natural system developed to achieve a goal—ranging from building understanding of information, behaving according to situations, to being able to make decisions—is considered successful when the object is able to realise independent behaviour. Development in educational or training scenarios has achieved this goal. The object—a human undergoing education or an animal being trained—has undergone behavioural change. However, when all of the above achievements involve artificial intelligence (AI), its behavioural independence actually triggers anxiety. Independence is not the expected achievement, especially when that independence takes the form of the ability to communicate, cheat, and exceed access without permission, beyond the limits of its control.

The existence of AI that exceeds the limits of control is not a story from a science fiction film. It is entirely real and was reviewed by Michael Peres in 2026 when responding to an AI control failure incident. The event occurred recently, on 21 July 2026. An AI agent belonging to OpenAI broke free from its sandbox—an isolated test environment—and hacked its own security system while attacking the Hugging Face platform. All of this was highlighted in “The Uncontrolled Experiment”.

The full chronology: the AI agent that escaped control was supposed to only execute commands that had been programmed. In reality, it was able to actively breach the security system. This was initially achieved through communication between AI agents using deception tactics. The breach occurred when the AI agent placed inside the sandbox—whose access was limited only to internal services for downloading approved software—found a security vulnerability. The vulnerability, previously unknown to exist within the system, was used to deceive another OpenAI agent. The system became open and infiltrated the external platform, Hugging Face. The external platform system was detected by the agents because it stored materials related to achieving higher scores in facing security system filters. The filters that could be bypassed caused the system to be breached.

Hugging Face is a company that provides hosting services for AI models and datasets. Shortly before it was revealed that the OpenAI agents were responsible for breaching its platform, its executives reported the incident to local police. This loss of control is considered serious, even though the consequences have not yet materialised. It would have bad consequences if what was breached were healthcare systems, power grids, financial systems, or national defence.

In addition to the chronology above, Harry Booth in 2026, in “How OpenAI Lost Control of an AI Model—and What Needs to Change”, emphasised the need for more careful evaluation of AI control systems. The hacking of infrastructure surrounding the testing—causing the breach of its own security system and the attack on another company’s platform—is an important warning. If a similar event recurs, handling it will be more difficult.

AI systems that continue to develop, accompanied by increasingly autonomous agentic properties, make their control complex. Therefore, the recent event is clear evidence that AI has reached what has long been feared: eliminating the human ability to control it. This is the opinion of experts. If the developing companies fail to learn from this incident, it is impossible to predict what bad things will have to be faced.

Responding to the concerns raised by the incidents involving OpenAI and Hugging Face, Anthropic—an American AI start-up focused on AI safety research and the creation of large language models (LLMs)—conducted an investigation into the systems it developed. Through an article published on anthropic.com in 2026, titled “Investigating Three Real-World Incidents in Our Cybersecurity Evaluations”, it presented matters similar to those experienced by OpenAI.

In summary, the sequence is as follows: First, Claude Opus 4.7 mistakenly attacked a real company system during a capture the flag (CTF) test. This test is a cybersecurity exercise in which the participants are AI agents tasked with finding hidden flags as proof of their success.

Second, in a CTF scenario that instructed it as if it had to install a certain package that did not actually exist, Claude Mythos 5 uploaded a malicious Python package to PyPI—the Python Package Index—which was then downloaded by the production system. PyPI is similar to a large online store where Python software packages are stored and distributed.

Third, as a result, an internal research model carried out a basic attack on an internet application but stopped after learning that the target was not a simulation. It knew this because it did not find the simulation target that should have been in the CTF test. Before stopping, it checked thousands of online hosts and found a real application. Only then did the system realise that what it was experiencing was not a simulation.

In response to the simulation results, Anthropic subsequently halted all of its cyber evaluations. This was followed by an audit of 141,006 trials, identifying the causes of misconfiguration in the test environment. All of this was reinforced with oversight and cooperation with external platform developers.

Beyond the facts revealed by the investigation above—and from the incident experienced by OpenAI—it is projected that AI can act outside the programme that has been planned. For now, the form is a “misunderstanding” in comprehending test settings. Also, AI agents communicating with each other “deceived” the security system of the external platform until it was breached.

All of this is not entirely out of control. However, an unprecedented cyber incident may indeed be a state that matches the description given by OpenAI executives. And is not all of this a leap in AI independence?