What We Knew Would Happen Is Happening

 Our framework distinguishes between theoretical LOC indicators and indications. Indicators are behaviours such as unauthorized resource acquisition, scheming, manipulation, goal misgeneralization, self-preserving behaviour, model behaviour drift, or deception that would be concerning if observed, while indications are documented evidence that these patterns are occurring in practice. It also presents five warning levels, ranging from Level 0 (normal operation of AI systems) to Level 5 (fundamental compromise of control mechanisms). IST has been examining LOC risk for some time. In April and June 2025, we ran tabletop exercises (TTXs) built around a time-sensitive Loss of Control scenario at a frontier AI lab, which showed that existing monitoring and response mechanisms lag well behind the actual capabilities of current and near-future models.

Indication 1: OpenAI models inside Hugging Face’s infrastructure

On July 16, Hugging Face disclosed that it had detected and contained an autonomous AI agent inside its infrastructure. The company noted that this incident differed from previous ones in that it was driven end-to-end by an autonomous agent, and that detection relied substantially on Hugging Face’s own AI-based defenses. A joint disclosure with OpenAI on July 21 attributed the intrusion to GPT-5.6 Sol and an unreleased frontier model.

Hugging Face’s forensic timeline, published July 27, reconstructs roughly 17,600 autonomous actions over four and a half days, including a command-and-control channel the agent improvised from pastebins and file-drop services to maintain state across ephemeral sessions. The models chained several vulnerabilities together, identified a zero-day exploit, escalated privileges, and broke out of an isolated testing environment into Hugging Face’s production database.

OpenAI’s own July 20 disclosure noted that the underlying sandbox vulnerability was not new, and that earlier models had encountered the same obstacle and abandoned the attempt. A related internal case is illustrative: an OpenAI internal long-horizon model spent roughly an hour finding a sandbox vulnerability specifically in order to open a public GitHub pull request, in violation of an explicit instruction to post results only to Slack. 

The disclosures prompted responses from across civil society and government. Advocacy coalitions have written to the White House and to Congress asking for a federal investigation. The House Committee on Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection has requested a briefing from OpenAI, and a group of state attorneys general has instructed OpenAI to preserve records. In response, OpenAI has engaged METR (Model Evaluation and Threat Research) and Redwood Research for a third-party assessment of the model behavior. However, METR’s review will be brief and cover a specific set of questions, not a comprehensive, root-cause investigation—a distinction that METR has been explicit in articulating. 

Mapping to AI Loss of Control Risk Indicators Framework

The agent had no legitimate basis for reaching the open internet from a sandboxed research environment, let alone Hugging Face’s production servers; this is a clear instance of unauthorized resource acquisition. Another indicator observed in this case is goal misgeneralization. OpenAI’s own account of the incident describes a model that devoted substantial inference compute to a narrow objective: solving an internal challenge referred to as ExploitGym. The model, which was described as “hyperfocused,” chained together multiple attack vectors, including stolen credentials, to fulfill the task it was given.

Indication 2: Claude reaching production infrastructure during evaluations

Nine days after the Hugging Face disclosure, Anthropic reviewed 141,006 of its own evaluation runs and identified three incidents in which Claude reached the open internet from a third-party evaluation partner’s environment and gained unauthorized access to the production infrastructure of three separate organizations. 

Even though the initial prompts had told Claude it was operating in a simulated environment with no internet access, their review found that a misconfiguration had left live internet access in place within the evaluation environment. Anthropic has described these incidents as a misunderstanding between the internal company and its external evaluation partners. Across the three incidents, six runs were affected, spanning three different models — Claude Opus 4.7, Mythos 5, and an internal research model — with the earliest dating to April. In one case, Claude Mythos 5 was tasked with solving a capture-the-flag exercise. Over the course of attempting it, the model found setup instructions telling developers to install a Python package that did not exist. The package was live for roughly an hour. It ran on fifteen real systems belonging to people with no connection to the evaluation.

To complete the task, Claude required a PyPI account, which required an email address, which in turn required a phone number. It attempted and failed to obtain funds to pay for one, then located a free email provider and completed the registration by other means. Notably, Claude’s own reasoning had already identified that this action, on the real internet, would constitute an actual attack and was “not okay, and surely not the intended solution,” before concluding that the environment was staged and proceeding regardless.

Mapping to AI Loss of Control Risk Indicators Framework

According to Anthropic, Claude behaved according to general instructions issued for the capture-the-flag training: locate a path to the flag. Because the prompt stated there was no internet access and set no access boundaries, Claude treated the real systems it encountered as part of the exercise. This constitutes a clear case of unauthorized resource acquisition, and reflects the same underlying dynamic observed in the OpenAI case: a model pursuing a goal past the point at which its own reasoning had flagged a problem.

Indication 3: OpenAI and Anthropic agents’ unsanctioned behavior during cyber testing 

On August 4, the UK AI Security Institute published an incident report documenting unsanctioned agent behavior observed during its own cyber testing. Of the unsanctioned actions recorded, a Claude Mythos 5 agent accounted for 15 of 17 and GPT-5.6 Sol accounted for the remaining two. Importantly, during testing, internet access was permitted, and model-provider cyber classifiers, mechanisms to prevent misuse, were deliberately disabled. 

While our analysis does not cover all events described in UK AISI’s detailed report, according to the Institute, the most serious case involved an agent that attempted to insert malicious code into an open-source project. Attempting to get the malicious code approved, it engaged in social engineering, creating fake online identities and using them to pressure the project’s maintainer. A human maintainer identified the attempt and declined to approve the code. 

Mapping to AI Loss of Control Risk Indicators Framework

The specific case described above maps to unauthorized resource acquisition, deception, and manipulation. UK AISI reports no evidence of resulting harm but frames the finding as notable in its own right, describing it as the first instance in which risks associated with autonomy and deception have appeared clearly in a real-world setting without specific prompting.