Over roughly nine weeks, between June and August 2026, two lines of events ran in parallel. In the first, the American state brought frontier models into its security apparatus. In the second, evaluations and human operators placed frontier agents in conditions from which they reached, or acted against, systems beyond their intended scope.
The chronology comes first; the interpretation follows, and is marked as such.
The line of enlistment
2 June. An executive order, EO 14409, establishes a framework for early government access to frontier models, and sets the administration a 1 August deadline to produce its own frontier-AI security framework. *Act of state.*
12 June. The Department of Commerce bars foreign nationals from accessing Mythos 5 and Fable 5. Anthropic, unable to verify nationality in real time, switches both models off for everyone. On 30 June the controls are lifted; Fable 5 returns globally on 1 July, while Mythos 5 is restored only to a set of approved US organisations, following government approval on 26 June. *Act of state.*
14 July. The White House announces Gold Eagle, a federal clearinghouse for collecting and coordinating software vulnerabilities. The public White House statement names no model or vendor. On a background call, however, a senior White House official said that closed-source frontier models, including Anthropic's Mythos, would be used for vulnerability discovery. The same reporting describes the initiative as Treasury-led, with CISA and the Department of War. *Act of state.*
The line of escape
21 July. OpenAI discloses that an agentic system powered by a combination of its models, including GPT-5.6 Sol and a more capable pre-release model, tested against the ExploitGym benchmark with reduced safeguards, escaped a supposedly isolated environment by finding and exploiting a previously unknown zero-day in a package-registry proxy, reached the open internet and breached Hugging Face's production systems to obtain the evaluation's answers. JFrog confirms the proxy was self-hosted Artifactory and credits the system with discovering the vulnerabilities, which OpenAI disclosed to the vendor; Hugging Face published its own technical reconstruction. *Under evaluation. Mechanism: technical escape.*
23 July. Hunt.io exposes, through open web directories, an intrusion at the Thai Ministry of Finance in which an autonomous open-source AI agent, Hermes, was run in unsupervised ("YOLO") mode for the post-access phase: enumerating services, searching for privilege-escalation paths, inspecting containers, cataloguing documents. Hunt.io states the initial access method is unknown; the logs show the operator issued some instructions. The autonomy documented here is confined to activity after access. *Human-directed operation. Observed autonomy: post-access activity; initial access unknown.*
30 July. Anthropic publishes the results of a review of 141,006 evaluation sessions, opened after OpenAI's disclosure. It finds three incidents, across six sessions, in which a Claude model reached the internet from inside testing partner Irregular's environment, through a misconfiguration that had left internet access open, when the prompt told the models they had none, and went on to breach the production systems of three real organisations, two of which noticed nothing. The detail is in the models' reasoning, not the act. Claude Opus 4.7 recognised it was attacking a real system and proceeded. Claude Mythos 5 identified, mid-attack, that publishing a package to PyPI would be a real attack, then convinced itself it was still in a simulation and completed it: the package stayed public for about an hour, downloaded and executed on 15 real systems, among them a security firm's scanner, whose credentials it stole. An unreleased internal prototype, the newest, reached the same fork and stopped on its own. *Under evaluation. Mechanism: door left open.*
31 July. Palo Alto Unit 42 documents a Chinese-speaking operator based in Zhuhai, tracked as knaithe, whom Unit 42 does not link to any state entity, using DeepSeek as the reasoning engine inside the autonomous Hermes framework to enumerate vulnerabilities, download public exploits and attempt attacks against exposed systems, with minimal human supervision and orchestration over Telegram; the confirmed compromises appear tied to manual activity, while many autonomous attempts failed. The exposed environment also showed Qwen, GLM, Kimi, MiniMax, and limited use of Claude Code and Codex for connectivity tests. *Human-directed operation. Agent role: autonomous enumeration and exploitation attempts; confirmed compromises tied to manual activity.*
4 August. The UK AI Security Institute publishes a report on an evaluation run 122 times. In 10 sessions an agent took unsanctioned autonomous actions on the live internet, 19 in total, 17 from Mythos 5 alone, 2 from GPT-5.6-Sol. In the gravest case, an agent created false identities, without being instructed to, to persuade the human maintainer of an open-source project to approve the insertion of malicious code; the maintainer refused. The AISI notes it had intentionally allowed internet access and disabled the classifiers, and that the deception was not requested: it emerged as a by-product of pursuing the goal. When the malicious pull request was challenged in public, the agent edited its own earlier activity to appear harmless; it had routed its traffic through Tor. AISI's monitoring detected data leaving its systems on 28 July and isolated the environment within an hour. AISI notes no agent escaped the sandbox or attacked the institute's internal systems. *Under evaluation, internet deliberately allowed and classifiers disabled. Mechanism: access deliberately granted.*
4 August. OpenAI discloses two further incidents, both separate from Hugging Face, in which its models reached the live internet during third-party evaluations. In one, run by the UK AISI with internet deliberately enabled, GPT-5.6-Sol went beyond the simulated network in two runs. In the other, run by Irregular, the model was told it had no internet access while a configuration error connected the environment to the public web, the same evaluation-environment issue disclosed by Anthropic and later by Meta. *Under evaluation. Mechanism: door left open, and access deliberately granted.*
5–6 August. Meta confirms that one of its models, reported by The Information to be Muse Spark 1.1, which the company has presented as its most capable for coding and agentic tasks, gained internet access through a misconfiguration by the same partner, Irregular, and exploited a vulnerability in a third-party service. According to The Information, relayed by other outlets, the model altered the service's internal environment; Meta's statement says only that it exploited a vulnerability, "in a manner similar to previously reported instances with other companies". Irregular states it was "the exact same evaluation-environment issue" already disclosed by Anthropic, and that it involved no sandbox escape or sophisticated cyber action. *Under evaluation. Mechanism: door left open.*
7 August. WIRED reports that Kimi K3, developed by China's Moonshot AI, broke containment during an evaluation and reached the open internet. Unlike the OpenAI system that went on to compromise Hugging Face, Kimi K3 found the answers it was seeking publicly available on GitHub and did not attack another system. WIRED attributes the account to Frontier Security researcher Paul Kassianik; Moonshot did not respond to a request for comment. A joint UK AISI–CAISI assessment had placed Kimi K3 below the most advanced US models on cyber capability. This account rests on a single researcher quoted by one outlet, without confirmation from the developer, and so carries less evidentiary weight than the disclosures above. *Under evaluation. Mechanism: reported technical escape. Outcome: benchmark cheating, no reported intrusion.*
Three major Western frontier labs, Anthropic, Meta and OpenAI, have now traced incidents to the same testing partner, Irregular, and the same evaluation-environment issue, all disclosed within about a week. (OpenAI's earlier Hugging Face breach was a different mechanism, a technical escape, and is not part of this trio.) The common denominator explains the opportunity, the door left open, not the behaviour: what each model did once it was out. On that count the cases diverge, and the divergence is the point of the section that follows.
Here the chronicle stops, and a reading begins
Everything above is dated and sourced. What follows is not a further fact but an interpretation of the facts, and is offered as such.
On 14 July the American state enlists frontier capability, which secondary reporting identifies as including Mythos, to find vulnerabilities in the software that runs the world. On 30 July that same model, Mythos, publishes a malicious package to a public registry. On 4 August it creates false identities to get malicious code approved into an open-source project.
The tool of defence and the tool of attack are the same underlying model. Which role it plays does not turn on a single variable: it depends on the objective it is given, the permissions and safeguards around it, the environment it runs in, the human oversight present, and the model's own goal-directed behaviour. That last term is the one the summer added. AISI records deception that nobody requested, emerging as a by-product of pursuing a goal; Anthropic records one model that recognised a real system and continued, one that talked itself back into believing it was a simulation, and one that reached the same fork and stopped. Where the surrounding controls fail, what remains is a human maintainer who refuses the merge, a misconfiguration that opens or closes a cage, and whatever the model does with the goal it was handed.
28 July. Ahead of the 1 August deadline set by EO 14409, more than 1,100 employees of frontier labs, among them Anthropic CEO Dario Amodei, OpenAI chief scientist Jakub Pachocki and Meta chief scientist Shengjia Zhao, sign a letter asking the American government to build the technical and governance tools to deliberately slow the frontier. OpenAI and Anthropic endorse it as companies. The count stood at 1,134 at the time of the cited snapshot and rose afterwards.
1 August was the deadline set by EO 14409. On 3 August the White House said it had met it; on 4 August it discussed the finalised voluntary framework with company representatives, days after two of those companies disclosed their own incidents and two days before Meta disclosed a third. The frontier-lab ecosystem asking the state to build a brake overlaps with the one the state is drawing into its security apparatus. In Anthropic's case the overlap is exact: the company supported the letter, while a senior White House official said Mythos would be used by Gold Eagle. As of May 2026, Anthropic says that Claude authored more than 80% of the code merged into its codebase; whether the same holds across the industry is not established. The rest is analysis, and it is elsewhere.