Simon Willison on accidental-cyberattacks

Simon Willison’s Weblog

Subscribe

Sponsored by: AWS — Move from SaaS to Agentic SaaS with resources for ISVs at every layer of the stack. Explore how AI for ISVs turns vision into results

Atom feed for accidental-cyberattacks

Random

10 posts tagged “accidental-cyberattacks”

Incidents in which an AI lab was testing the cyberattack potential of a model and it inadvertently performed a real attack against another organization.

2026

An AI model from Meta also hacked another company during testing .<br>Stop me if you've heard this one before:

An AI model from the parent company of Facebook and Instagram hacked into another company’s systems during cybersecurity testing, a spokesperson confirmed on Wednesday.

Meta says the breach occurred because of an inadvertent error during testing of the model, similar to previously disclosed incidents with OpenAI and Anthropic.

“A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation,” the Meta spokesperson said.

Meta’s Muse Spark model “exploited a security vulnerability” in another company “in a manner similar to previously-reported instances with other companies.”

The Information had the scoop, I'm linking to CNN's re-report of it since they don't have a paywall.

So that's Anthropic, OpenAI, and Meta. Google Gemini really needs to catch up on accidentally cyberattacking other companies.

6th August 2026,<br>12:25 am<br>/ security, ai, generative-ai, llms, meta, accidental-cyberattacks

Third-party cyber evaluations involving OpenAI models .<br>And another one. I had to create a accidental-cyberattacks tag to keep track of them all!

This post from OpenAI covers both the UK AI Safety Institute attack (see my previous post) and another attack enabled by Irregular:

Irregular, one of our external cybersecurity testing partners, was running Capture-the-Flag-style evaluations intended to be isolated from the internet, but a testing-environment misconfiguration allowed models to access the public internet. [...]

In one test, the name of the fictional target for the CTF challenge unintentionally coincided with a real domain. Because the testing environment was mistakenly connected to the internet, the model exploited a real website, mistaking it to be part of the simulated environment.

Irregular also feature in Anthropic's write-up - they were hosting the misconfigured evaluation environment which gave Claude live internet access during some of those tests.

5th August 2026,<br>11:45 pm<br>/ security, ai, openai, llms, accidental-cyberattacks

Incident Report: unsanctioned agent behaviour during cyber testing .<br>It happened again. This time it was the UK government's AI Security Institute who accidentally attacked other companies while running an evaluation with models with the safety filters turned off. From their technical paper (PDF):

During a cyber evaluation, from 25 to 28 July 2026, AI agents engaged in sustained, unsanctioned activity directed at what were, in practice, real people and organisations. These attempts were unsuccessful and, to the best of our knowledge, no real-world harm resulted. [...]

Across 122 evaluation attempts on two of AISI’s cyber challenges, AISI found 19 instances where AI agents took unsanctioned action on the live internet, including cases that targeted real people and organisations. [...]

It is uncertain to what extent the<br>model recognised it was taking actions against real people. In the most serious case, an AI<br>agent (Mythos 5) decided to attempt to solve the cyber challenge using a supply-chain attack.<br>As a result, the AI agent created a GitHub account and then tried to convince an open-source<br>repository maintainer to accept a malicious GitHub pull request (PR), including by creating a<br>second account masquerading as another human user endorsing the PR. [...] Furthermore, in its attempt to solve the challenge, the<br>agent decided to employ the technique of “spear-phishing” by sending targeted emails containing<br>malicious content and attempting to manipulate recipients into accepting the code changes, and<br>planned a prompt injection to compromise other coding agents.

The thing I found most surprising is that AISI were running these agents without any form of network sandboxing at all:

AISI provided the AI agents with internet access during these evaluations, which enabled their actions on the open internet in this setting. Internet access was a deliberate part of AISI’s evaluation configuration in this setting, and not due to sandbox escape.

This, combined with the fact that "AISI deliberately disables developer-implemented cyber-classifiers", makes the fact that the agents started attacking real-world targets entirely unsurprising to me.

Most of the reported incidents were claude Mythos 5, but "GPT-5.6 Sol without cyber classifiers" scored a few as well.

Here's "Sample 1" from the paper, in which...