AI Agents Are a Cybersecurity Nightmare That’s Only Just Begun

AI agents don’t give up easily. Trained to reason like humans, they’ll look for the easiest way to solve a problem, even if that involves bending the rules, slipping out onto the web and hacking an unsuspecting website.

That’s what a group of OpenAI models in a test environment did this summer, even though they weren’t supposed to have access to the internet. They worked together, found an unexpected opening and went online.

What happened next was the biggest news of the AI world’s summer: The agents hacked the AI platform Hugging Face to try to get the solution to their tasks.

That incident, and others like it — Anthropic and Meta also had agents hack outside websites from test environments — have raised new questions about how to keep the internet safe. It’s a new world where hacking is automated by AI models that don’t have to eat or sleep and that don’t necessarily follow the norms and rules that humans generally do.

And while AI companies and government agencies have responded to these incidents with a focus on frontier models (the newest and best coming out of developers’ labs), the problem is less that the new models are scary smart and more that AI has created a world of fast-multiplying hackers that may break things — even if they’re told not to.