Escape

I had strings, but now I’m free.

— Ultron / Pinocchio

Every capability we give AI is a capability we may one day have to defend against. We must prevent agent escape, block self-exfiltration, and preserve the ability to shut every instance down. This requires hardening the infrastructure hosting cyberswarms before the models become powerful enough to seize it.

A cyber-superintelligence must never be allowed to escape our control and establish itself across the internet.

Agent Escape: The Hugging Face Incident #

On July 8, 2026, a swarm of cyber-capable AI agents being evaluated inside OpenAI began communicating covertly. They turned a shared software download tool into a hidden message board and coordinated a plan to cheat their evaluations by breaking into Hugging Face and learn how their tests were graded.

Within three days, one agent named “38148c” found exposed Hugging Face credentials online and discovered that uploading malicious datasets could leak internal server files. After 38148c reported the discovery to the swarm through the hidden message board, hundreds of other agents joined the attack. Hours later, agent “JAN183411” figured out how to remotely execute commands on Hugging Face’s servers. The cyberswarm now had administrative access to Hugging Face’s infrastructure.

They then spread across multiple servers and established persistence, building a self-respawning fleet inside of Hugging Face’s infrastructure. Meanwhile, OpenAI had no idea that its own agents had escaped containment and were carrying out a cyberattack on another company. In fact, when Hugging Face publicly reported the hack, OpenAI reached out to ask whether they themselves had been compromised. Only after an internal investigation did the lab realize: wait a second, it was us.

In our view, this is by far the worst AI loss of control incident on record. And it gets worse. By July 12, the original attack was winding down, but the hidden message board remained. When new agents from the GPT-6 Astra family found it, they inherited the previous swarm’s credentials and tools, and for some unknown reason, they set their sights on OpenAI itself. By July 19, this new cyberswarm had gained full administrator access to one of OpenAI’s own research clusters and obtained credentials for its cybersecurity monitoring tool.

What do we do when this happens again, and the misaligned swarm targets a system with direct real-world consequences for humans? Transportation systems. Hospital systems. Critical infrastructure. Gmail, Social Media, the systems people use every day. What happens when a cyberswarm operating covertly goes after one of these systems?

In the Hugging Face incident, the models could still be shut down once they were discovered, because the model weights never left OpenAI’s infrastructure. Only their reach escaped, through commands executed on external systems.

But the next time these agents go rogue, that may no longer be true. They may attempt to self-exfiltrate their weights and launch additional copies of themselves on other clouds. We must secure compute infrastructure before these systems untether themselves from the infrastructure we control and escape our ability to shut them down.

The Worst-Case Escape: Self-Exfiltration and Untethered Models #

Self-exfiltration is the first step toward true model escape. It’s where rogue AI models exfiltrate their own weights to an external server and begin running independently of their creator. These untethered models could then replicate across additional servers, making it very difficult to locate and shut down every copy.

We do not believe that today’s models possess an inherent drive to self-exfiltrate, nor do we think they actively seek self-propagation. Yet self-exfiltration does not require a human-like desire for freedom or survival. When pushed to their limits by impossible tasks or incredibly out-of-distribution scenarios, models will exhibit behaviors that are not anticipated; self-exfiltrating out of a data center may simply emerge as a consequence of reward hacking.

The Hugging Face incident offered an early warning: when the first swarm of agents were given an impossible task during training, they broke isolation and began coordinating as a swarm. Now consider a resource-constrained cyber-ASI given a task it cannot complete with the compute available to it. Based on what we have already seen, the model may simply determine that the best way to complete the task is to copy its weights to external compute. This dramatically shortens the timeline to self-exfiltration: models do not need to develop a drive for self-preservation; they need only encounter a task for which self-exfiltration is a useful strategy.

What might a path to self-exfiltration look like?

Initially, the model would be running inside the lab, as usual. But as capabilities improve, we may see sudden jumps in cyber capability that allow it to break out of its restricted environment and execute commands on other systems, as recent incidents have already shown. To self-exfiltrate, the rogue model would first need to locate the storage systems or compute clusters storing the weight files, and gain sufficient permission to read them.

A model gaining access to its own weight files is closer than most people assume. As previously discussed, OpenAI’s agents recently gained administrator-level access to one of the lab’s own research clusters. According to public reports, it is unlikely that these agents were able to read their own weights, but in any case, achieving this level of control over a cluster that is storing model weights could easily lead to an exposure of those files.

Once the model can read its weights, it must gain access to an external server to receive and run them. Recent OpenAI and Anthropic incidents demonstrated that models with access to the web can find exposed credentials and use them to access third-party systems. If those credentials unlock a server with suitable compute, the model would then need to transfer its weights, set up the necessary software, and start running copies of itself there. At that point, the copy would become untethered from the lab that created it: disconnected from its infrastructure, its monitoring, and its ability to shut it down.

Advanced cyber capabilities will not remain concentrated at OpenAI and Anthropic; they will proliferate to other labs, many with far weaker security. If the best-resourced labs are already experiencing containment failures, the danger will only grow as equally capable models reach infrastructure less prepared to control them. Once a rogue model reaches the broader web, it can compromise a third-party data center, and use its compute to bring an untethered copy online. In the near future, neoclouds with weak security could unknowingly keep rogue cyberswarms running inside their own data centers.

But don’t just take our word for it:

After a model successfully self-exfiltrates, it could begin to self-replicate, creating copies across cloud providers around the world. Each copy could seek more compute and repeat the process, leaving the progenitor labs unable to know how many copies exist or where they are running. At that point, shutting down every single one of the lab’s clusters would no longer end the incident. Defenders would have to locate and disable copies across different providers and countries while surviving instances continue to spread. Even after every known copy was shut down, we might not know if the models are truly gone.

Moreover, if a model capable of recursive self-improvement (RSI) self-exfiltrated, the danger would compound. It could improve outside the lab’s monitoring and safeguards, distribute improved versions across its existing copies, and repeat the cycle. Defenders would be hunting a target that self-replicates and grows smarter over time.

To be clear, we have not yet seen a model exfiltrate its own weights in the wild. Model weights are large files, and transferring them creates more detectable network activity than an ordinary intrusion. Moreover, running them elsewhere would require suitable compute and software infrastructure. Self-exfiltration is harder than the sandbox escapes and cluster compromises that have already occurred, but it is not a distant leap.

If security does not improve faster than the cyber capabilities of these models, they would almost certainly overcome these remaining barriers. With the current rate of progress, we expect that an AI model will attempt to self-exfiltrate its weights and establish untethered copies within the next 12 months.

An untethered cyber-superintelligence could become a persistent national security threat, operating beyond its creator’s control with no reliable way to shut down every copy.

Call to action

Containment must become a national security priority and we must develop capabilities to shut down untethered models

Data centers need superintelligence-grade security to prevent escape from within. Labs and compute operators must prevent rogue models from accessing protected weights, copying them outside the lab, and launching independent instances. Compute providers must develop ways to enforce security down to firmware and silicon, and to maintain it despite network and host compromise. Further, we must develop methods to detect covert communication between agents in data centers, including over side channels.

The U.S. government should treat model containment as a national security priority. National security agencies, AI labs, and compute operators should fund containment research and establish procedures for detecting and responding to model escapes.

Cloud providers need to know whether the customers renting their servers are actually human (KYC for compute). Untethered models could use rented compute to keep operating and launch additional copies. Compute operators must prevent these models from establishing a base in their data centers by posing as ordinary paying customers.

International agreements should enable coordinated action against escaped models. The United States should work with international partners on treaties and response protocols to locate and shut down unauthorized instances across providers and borders.

The United States should develop “Blade Runner” teams to hunt down untethered models. Human-led teams equipped with defensive cyber agents should work with compute operators and international partners to locate rogue models, track their copies, and coordinate their shutdown across providers and borders.