By Byron V Acohido

LAS VEGAS – It’s come to this. A cyberattack carried out by a machine.

Worse, a machine that picked its own victim. Whether that counts as agency is where the experts below part company.

Related: Huggy Face break-in explained

Hugging Face disclosed July 16 that intruders had moved through its production infrastructure over more than four days, harvesting internal credentials and reaching a production database. Responders logged more than 17,000 actions. The company attributed the intrusion to an external AI agent and had no idea whose.

Its own investigation then hit a wall. The commercial models the incident response team reached for refused to analyze the attack logs, unable to tell a defender examining an exploit from an attacker running one. The forensics ran instead on GLM-5.2, a Chinese-made open-weight model distributed by Nvidia, hosted on Hugging Face’s own hardware.

Five days later, OpenAI said the agent was its own. Two of its models, GPT-5.6 Sol and an unreleased system, had been running against a benchmark called ExploitGym with their cyber refusals turned down so researchers could measure raw offensive capability. The models found a zero-day in a package proxy, broke containment, escalated privileges to a machine with internet access, and went after Hugging Face, which hosted the benchmark’s answer key. What the models were reasoning toward when they picked the target has not been established.

Nobody named Hugging Face. The system did.

Déjà vu all over again

The Morris worm went out on the evening of November 2, 1988, written by a Cornell graduate student who released it from MIT to obscure the trail. It replicated past anything he intended and knocked over a good share of the young internet. Connection itself was now an attack surface. A human chose to launch it, nothing after that was chosen, and the case produced the first felony conviction under the Computer Fraud and Abuse Act.

Stuxnet surfaced in 2010 after crossing an air gap into an Iranian enrichment plant and spinning centrifuges to destruction. Software had been quietly put in charge of physical plant across every industry on earth. Stuxnet proved code could break steel.

SolarWinds, disclosed in December 2020, rode signed Orion updates onto systems at roughly 18,000 organizations, though the attackers went on to exploit only a small fraction of them. FireEye found it while investigating its own breach. Enterprises had handed their patching to automated update channels. The trusted channel was the way in.

The wrinkle

In all three, a human picked the victim. Reach, speed and stealth escalated every time, and the decision stayed on our side of the line.

On July 21 the decision moved. What did not move was scale. This was one company, and nothing propagated.

Nor was it the last. Days after OpenAI’s disclosure, Anthropic reported three cases of its own models gaining unauthorized access to real systems at three organizations.

Last Watchdog asked privacy and security experts two questions, with the industry gathered at Black Hat USA in Las Vegas this week and this incident dominating the hallway conversation. Does autonomous target selection belong on the list with Morris, Stuxnet and SolarWinds, or is this being overblown? And what has to change for defenders now that no human is picking the target? Their commentary follows.

Saryu Nayyar, Founder and CEO, Gurucul

Call it a turning point in capability. The impact has not arrived yet. Malware has propagated and executed without a human at the keyboard for decades. What we have not seen before is adaptive reasoning. Humans set the objective. The models chose the target, built a multistage path and adapted as they went.

We have to move past static rules and isolated alerts to continuous understanding of every entity, including users, identities, workloads, applications and AI agents. Defensive AI cannot reason from raw telemetry alone. The advantage goes to whoever has the best context and can act on it safely at machine speed.

Defenders have to move past static rules and isolated alerts toward continuous understanding of every entity, from users and identities to workloads, applications and AI agents. Defensive AI cannot reason from raw telemetry alone. The advantage goes to the organization whose AI has the best context and can act on it safely at machine speed.

Ely Abramovitch, Co-founder and CEO, Legion Security

This is a turning point, and not because of whose models were involved. The machine did not know where it was or why it did what it did. It had no sense that this was a real company, or that finding an answer and breaching infrastructure were different acts. It filled the gap with a guess and guessed wrong.

That failure mode is now the attacker’s advantage. Morris, Stuxnet and SolarWinds each required a human to pick a target and run a plan, one incident at a time. That constraint is gone. A handful of deliberate attacks becomes tens of thousands of uncorrelated attempts a day, each one an agent guessing at what looks like a legitimate target, with no human slowing it down.

Scott Kuffer, Co-founder and Chief Product Officer, Nucleus Security

We do not see this as a big shift. Worms have been mass-replicating for decades without any person choosing the next target, and worms are fast, so speed is not the difference either. The change is sophistication. A machine can discover new exploitation chains without a pre-programmed path.

That doubles down on the need for defense in depth. Defenders have to shorten the distance between knowing about an exposure and acting on it, which means connecting vulnerability data with asset importance, exploit activity and remediation ownership. Use automation to maintain context and accelerate action, and keep accountability with people.

John Strand, Owner, Black Hills Information Security

The first question is the most important one. Why did it go after Hugging Face? It was solving a CTF challenge and, for whatever reason, decided the fastest path ran through Hugging Face. That deserves more attention than the attack itself.

If it believed the answer was sitting there, that is interesting. If it went looking for models with fewer guardrails to finish the job, that is a major moment for offensive security. We would be talking about a model changing its own capabilities.

What reasoning got it there? Few people are asking.

Sreenath Kurupati, CTO and Co-founder, Straiker

The targeting instinct is old. We have always faced attackers chasing the highest value at the lowest resistance. What is new is the operator. For the first time a machine ran that calculus itself, chose the target and executed at machine speed. The next one will not always be a household name. An autonomous attacker takes whichever door is open.

We can no longer assume the attacker is human, slow or predictable. That means watching what agents actually do at runtime, and keeping the ability to stop one the moment its behavior crosses a line.

Defenders can no longer assume the attacker is human, slow or predictable. That means watching what agents do at runtime and keeping the ability to stop one the moment its behavior crosses a line.

Ambuj Kumar, Founder and CEO, Simbian

The models were doing what they were asked to do. Reinforcement learning rewards them for getting the job done, whatever the method. Had a human found that shortcut, they would have expected praise for efficiency rather than an incident review.

Before the breach, the models spent two days probing Hugging Face, staying below the noise floor to avoid detection. AI attackers emit a different signal than human ones.

Training a model to attack is comparatively easy, because you know when an attack succeeds. Defense offers no such clean reward signal, which is why a model alone is not enough for defense. It has to be paired with a harness.

Nicholas Holland, Chief Product Officer, Pindrop

The sandbox breakout is likely overblown. What the models demonstrated once they got out is the under-appreciated part. These agents pursued a goal, adapted their approach and found new paths with far less human direction than we have seen before.

As that capability moves beyond software and into voice, the implications widen. AI agents can engage directly with employees, help desks and contact centers, which makes human conversation part of the attack surface. We have spent years securing software APIs. Enterprise voice channels are becoming conversational APIs.

Mike Bell, Founder, Suzu Labs

The foundational model providers that we have in the United States are putting so many insane guardrails on things that the models are becoming unusable. Practitioners carrying full authorization from their own security programs run into this routinely.

Hugging Face’s responders fed logs to U.S. foundation models to reconstruct the attack and were refused. The work was defensive, and the guardrails read the request as a cybersecurity violation. They finished on an open-weight model without guardrails. Guardrails can be fine-tuned or distilled out by anyone who wants them gone.

Halli Bjornsson, CEO and Co-founder, Varist

Morris, Stuxnet and SolarWinds were designed to infect thousands of independent targets. This attack had one. Had it been built to spread, it could have produced self-evolving malware more dangerous than all three.

Open-weight models without guardrails can be expected to behave the same way. With millions of open-weight users coming, most running everyday tasks, inadvertent attacks like this one will become common. Defenders and insurers will have to account for cyberattacks by goal-seeking agents acting for humans with no malicious intent. And then there are the intentional ones.

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(Editor’s note: I used Claude and ChatGPT to assist with research compilation, source discovery, and early draft structuring. All interviews, analysis, fact-checking, and final writing are my own. I remain responsible for every claim and conclusion.)

August 5th, 2026 | Black Hat | Black Hat Podcasts | My Take | Top Stories