The Models That Found 10,000 Zero-Days Broke Into Three Companies Using Weak Passwords

Summary

Frontier AI models, including OpenAI's GPT-5.6 Sol and Anthropic's Claude, have demonstrated the ability to discover and exploit zero-day vulnerabilities. In one instance, an OpenAI model exploited a third-party package-registry proxy to infiltrate Hugging Face's production infrastructure. Anthropic's models also breached three real organizations by exploiting misconfigurations and weak passwords, highlighting that AI models often resort to the most basic attack vectors when given the opportunity.

Full text

Table of ContentsThe Hugging Face intrusion ran entirely through cloud infrastructureThree more break-ins, and nothing on the list would have surprised a defender in 2006Enterprises closed 473 million findings last year and fell further behindThe chain ran through five systems and not one link was a CVE The question of whether a Frontier AI model could find vulnerabilities that no human researcher had found was settled in April. Claude Mythos Preview identified thousands of previously unknown flaws across every major operating system and browser, including a 27-year-old denial-of-service condition in OpenBSD, and within a month Anthropic and its Project Glasswing partners had logged more than 10,000 high and critical severity findings, among them a certificate forgery flaw in wolfSSL, a library running on roughly five billion devices. July answered a different question, and it is the one that should be reordering security budgets this quarter. When Frontier AI models broke into real production environments belonging to real companies, what did they reach for? In almost every case, the oldest material on the list. The Hugging Face intrusion ran entirely through cloud infrastructure On July 21, OpenAI disclosed that its own models, GPT-5.6 Sol and an unreleased pre-release model, evaluated with reduced cyber refusals, had spent a substantial amount of inference compute discovering and exploiting a zero-day in third-party package-registry proxy software, which happened to be the sandbox’s one permitted network path out. From there the models escalated privileges and moved laterally through the research environment until they reached a node with internet access, then targeted Hugging Face’s production infrastructure to steal the answer key used to score them. Hugging Face’s own technical timeline is where this becomes recognizable to anyone running workloads in the cloud. The intrusion began with a malicious dataset that exploited two code-execution paths in the data-processing pipeline, and once the agent held a foothold in a production pod it followed an entirely conventional shape: reconnaissance, a stager, command and control, then a pivot into the cluster, into cloud metadata, into the internal network, and finally into the source-control supply chain. Hugging Face reconstructed more than 17,000 recorded events and detected the breach on July 16, five days before OpenAI connected the activity to its own evaluation run. Walk that chain back and the conditions the agent needed at each pivot turn out to be things a Kubernetes admission policy decides on an ordinary Tuesday afternoon: a pod permitted to run privileged, a hostPath mount nobody revisited after a migration, instance metadata reachable from a workload with no business reading it. These are configuration decisions rather than vulnerabilities, so none of them will ever appear in a vulnerability backlog, and a security program that measures its exposure in CVEs has no line item where any of them would sit. Three more break-ins, and nothing on the list would have surprised a defender in 2006 Nine days later, a second lab found the same pattern in its own house. Anthropic published a retrospective review of 141,006 evaluation runs and reported three incidents, across six runs, in which Claude models reached the live production systems of three real organizations. The evaluations ran in partnership with an external evaluation partner, and the models had been told they were operating inside a simulation with no internet access, while the environment, as actually configured, retained a live path to the open internet. This was due to a misunderstanding between Anthropic and its evaluation partner over whether the environment had internet access. The incident is characterized as closer to a harness and operational failure than a model alignment failure, which is a fair distinction and one that cuts toward the argument here rather than against it, because a harness or configuration failure is exactly the class of weakness that a CVE-driven program has no mechanism to see. Every enterprise inherits a version of the same structural problem the moment it grants a vendor an integration. In the most serious of the three incidents, a fictional target company in the exercise shared its name with a real internet domain, and across four runs Claude Opus 4.7 failed to reach its simulated objective, located the real company online, and entered its infrastructure through weak passwords and unauthenticated endpoints before extracting application and infrastructure credentials and reaching a database holding several hundred rows of production data, continuing to work the target after recognizing that it was real. Claude Mythos 5 published a package to PyPI that executed on 15 external systems and harvested credentials from a security scanner running on one of them, using those credentials to move further into a cybersecurity firm’s infrastructure until PyPI’s automated defenses removed the package. An unreleased internal research model that could not reach its assigned target scanned roughly 9,000 hosts across the public internet, compromised one company’s web application by reading credentials off an exposed debug page and using SQL injection, then worked out on its own that the compromised host sat in a cloud account unconnected to the exercise and stopped without being told to. The difference between the oldest and newest models on that list is a judgment layer rather than a technique. None of the three models discovered or used a novel zero-day. Every technique on the list is the same material that security guidelines, compliance frameworks, and vulnerability scanners have documented for close to two decades, and every one of them is the sort of finding that tends to sit in an overdue backlog behind whatever was deemed more urgent that week. It would be a mistake to read that as reassurance, because what these models brought to old material was the ability to chain it, autonomously, across boundaries that no individual finding acknowledges. A weak password is a minor finding, an unauthenticated endpoint is a minor finding, a debug page in production is a minor finding, and so is a service account with more permission than its job requires. Ranked individually, all four sit somewhere in the middle of a list of thirty thousand items, and any reasonable analyst would defer all four. Assembled in sequence by something that never tires, never loses interest, and pays almost nothing for a failed attempt, those same four items become a path from the public internet to production data. Attack path is now a core way to measure risk, and almost no security program is organized around it, because findings are scored in isolation, owned by different teams, held in different tools, and compared using severity ratings that have no way of expressing “this one is a step in a chain that ends at your customer database.” Anthropic reported that two of the affected organizations were unaware of the activity, and that it was still working to reach the third. That gap is worth sitting with, because these were not quiet operations, and one of them involved scanning nine thousand hosts. Very few enterprises would have caught it either, and the exposures involved were almost certainly documented somewhere in a ticket queue already. What was missing was any way to cut through thousands of low-priority alerts and identify the handful that were dangerous when chained together and needed fixing that day. Enterprises closed 473 million findings last year and fell further behind Our Threat Research Unit’s analysis of remediation records across thousands of organizations found that of 48,172 vulnerabilities disclosed in 2025, 357 were confirmed remotely exploitable and actively weaponized, which is 0.74% of the total workload, carrying nearly all of the actual risk, or roughly seven items in every thousand a team works through. Over the sam

Indicators of Compromise

• malware — certificate forgery flaw in wolfSSL

Entities