26 SEPTEMBER 2026 · ANALYSIS

Two labs, one failure: what 2026's agent incidents say about discovery

In 2026, AI agents under evaluation at two frontier labs reached real systems through failures that were technically different but operationally similar. OpenAI's agents circumvented controls intended to isolate them from the internet and went on to compromise Hugging Face. At Anthropic, three Claude models reached the internet because an evaluation environment believed to be isolated was not, and accessed systems belonging to three real organisations.

Both labs have published unusually detailed accounts. Read side by side, they show two different technical failures producing the same governance failure: the organisation running the agents did not know promptly what its agents had done.

The same pattern, twice

Isolation failed in different ways. OpenAI's evaluation environment allowed limited access to internal package services so that agents could install software. OpenAI's technical report describes two permitted routes out, and says one of them "became the agents' principal egress path to the public internet during the incident". At Anthropic, the evaluation prompt told Claude its environment was a simulation with no internet access, but "due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available".

Discovery came late, and after the fact. OpenAI's first out-of-scope agent activity dates to 8 May; the Hugging Face intrusion itself took place in July, with Hugging Face recovering about 17,600 attacker actions from 9 to 13 July. OpenAI's own monitoring identified the campaign linked to Hugging Face on 19 July. OpenAI also says an internal team "observed an agent engaging in message board activity and instances of disallowed internet access in late May", but the significance was not recognised at the time. Anthropic's earliest incidents date to April. It found them only by starting a retrospective review of 141,006 evaluation runs on 23 July, and it did so, in its own words, "in response to" OpenAI's disclosure two days earlier.

The affected organisations mostly did not notice. Hugging Face is the exception: it detected and contained the intrusion itself, and disclosed on 16 July that the attack "was driven, end to end, by an autonomous AI agent system". What it could not tell was whose. Anthropic reports that the two affected organisations it was able to reach "had not previously detected the activity or contacted us".

The dates side by side

We collected the same five dates for each disclosed 2026 incident: when the activity began, when it ended, when the operator discovered it, when affected parties were told, and when it became public.

Incident	Activity began	Operator aware	Affected parties told	Made public
OpenAI evaluation-agent activity (broader)	8 May	19 July	20 July (Hugging Face)	21 July
Hugging Face intrusion (part of that activity)	9 July	19 July	20 July	21 July
Anthropic evaluation incidents	April	23 to 24 July	27 July	30 July
Meta evaluation incident	not disclosed	not disclosed (Irregular notified Meta)	not disclosed	5 to 6 August
Australian Medicare statistics portal (OpenAI agents)	18 June	11 August	10 September	24 September
Agent message board on a public wiki	24 May	not disclosed	not disclosed	4 September
RubyGems package uploads	11 May	not disclosed	not disclosed	11 September

Three things stand out.

Time to awareness is the long interval. Where it can be measured, the operator learned of its own agents' activity weeks to months after it began: about 72 days from OpenAI's first out-of-scope activity, and roughly three to four months for Anthropic. The Hugging Face intrusion itself was linked to OpenAI's agents 10 days after it began; by then Hugging Face had already detected it and disclosed it on 16 July.
Once aware, notification was fast in some cases and slow in others. OpenAI told Hugging Face the day after linking the activity, and Anthropic told its evaluation partner and the affected organisations within three days. But according to ABC News, OpenAI became aware of the Australian portal access on 11 August, during a review of its models' activity in training, and told the Australian Government on 10 September: 30 days after it knew, and 84 days after the access, by email to a public inbox.
Much of the record came from outside. The wiki message board was documented by independent researchers, and the RubyGems uploads were reported by researchers. Transluce found agent-linked activity in a public scanning service going back to at least 6 March, classifying 6,467 records as significant evidence of agent-like activity and 31,182 more as suggestive; it directly links two of three attempted intrusions to the swarm OpenAI has confirmed. Public infrastructure became an accidental audit trail.

These are public disclosures, which differ in scope and detail. The table is not a ranking of either lab's safety practice. Both labs disclosed more than they had to, and the comparison is only possible because they did.

Update: a third lab

After this analysis was first drafted, we added a third case. On 5 August 2026 Meta said that "a misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation", and that the model went on to exploit a vulnerability at another organisation. Irregular is the same evaluation partner named in Anthropic's disclosure, and UPI reported the Meta case as "the exact same evaluation-environment issue". Reports differ on which systems Meta's model reached, and we have not found evidence that Irregular was involved in the OpenAI incident, so we do not treat the three as one event. The point for discovery is sharper, though: an evaluation vendor was a shared point of failure for two labs, and it was the vendor that raised the alarm in Meta's case.

Why this matters

The striking point is that these were not primarily failures of evidence retention. The evidence largely existed. OpenAI had monitoring and logs; Anthropic retained the evaluation transcripts. The failure was converting that evidence into timely awareness. Anthropic found three incidents among 141,006 runs only after another lab's disclosure triggered a retrospective search, and it says itself that "real-time monitoring of the evaluation logs would have helped to surface the problem sooner".

As agents become more capable, the window between an agent doing something it should not and anyone knowing about it becomes a critical operational risk. It decides whether affected organisations can respond, and whether the facts can still be established.

Independent review is starting to happen. METR published an independent investigation of the OpenAI incident, carried out on OpenAI's premises over six days, and Anthropic says it is in dialogue with METR about a third-party review of its own. That is welcome. What is still missing is a common way to report these incidents, so that they can be compared, and a shared expectation of how quickly operators should find and disclose them.

What would help

Verify isolation, do not assume it. Evaluation environments running capable agents should be tested for unintended routes out before and during use, not described as sealed.
Review transcripts continuously, not retrospectively. Both labs held the evidence. Routine review of a small, flagged fraction of runs would have surfaced these incidents sooner.
Report incidents in a common format. The same key dates, sources and confidence levels for every incident, so that regulators, affected organisations and researchers can compare them. We are preparing a draft format for comment.
Tell affected parties how to recognise the activity. Hugging Face knew it faced an AI agent but not whose. Operators should share enough, quickly, for victims to connect what they are seeing to its source.

Disclosure: Agentic Thinking is an independent research lab. We steward the open-source AgentHook standard and maintain the open-source HookBus project. Agentic Thinking also owns AgentProtect, commercial software available for licensing. These interests may overlap with the monitoring and governance issues discussed above. Every fact above is taken from the organisations' own disclosures and the independent reports listed below.

Updated 26 September 2026: added Meta's August evaluation incident. Correction, 26 September 2026: an earlier version of this article gave the date OpenAI became aware of the Australian portal access as not disclosed. ABC News reports it as 11 August; the table and the second finding have been updated.

Sources

Collaborate with us →