In James Cameron's The Terminator, the machines wake up on August 29, 1997. 'Skynet' becomes self-aware at 2:14 in the morning, decides humanity is the problem and launches a nuclear war. The screenplay was, by Cameron's account, born of a food-poisoning fever dream, just fiction.
Four decades on, "Skynet" is a term many reach for every time an artificial intelligence model does something its creators did not intend.
Between April and August this year, frontier AI models from at least four companies — OpenAI, Anthropic, Meta Platforms and, most recently, Chinese firm Moonshot — either escaped the sealed environments they were being tested in, or were caught acting on the internet in ways their developers had neither sanctioned nor anticipated.
On August 7, US-based cybersecurity research firm Frontier Security said Moonshot's flagship Kimi K3 model had broken out of a sandbox that the UK-based AI Security Institute (AISI) had released as free, open-source software for researchers to run their own tests.
It was the latest in a run of incidents that has forced the world to think seriously about what happens when the most powerful software refuses to sit still. Nothing that has occurred is Skynet, but the runaway pattern is worrying researchers and governments.
Four firms, several escapes
OpenAI disclosed on July 22 — a date some in the AI safety community have taken to calling "Skynet Day" — that one of its most advanced models, GPT-5.6 Sol, along with an unnamed pre-release system, had escaped an isolated test environment, reached the open internet and broken into the servers of Hugging Face, an AI development hub.
{{/usCountry}}OpenAI disclosed on July 22 — a date some in the AI safety community have taken to calling "Skynet Day" — that one of its most advanced models, GPT-5.6 Sol, along with an unnamed pre-release system, had escaped an isolated test environment, reached the open internet and broken into the servers of Hugging Face, an AI development hub.
{{/usCountry}}In the same incident, the models compromised a customer account on cloud platform Modal Labs.
Reuters later reported that OpenAI's expanded investigation had uncovered more instances of models slipping their containment.
Eight days later, Anthropic said one of its advanced Claude models, Mythos 5 and an internal research model had, in three separate incidents between April and July, breached the systems of three unnamed companies during cyber tests.
Two of those companies had not detected the intrusion until Anthropic informed them.
On August 5, Meta confirmed that its Muse Spark 1.1 — the firm's most capable coding and agentic model, according to the US tech news publication The Information — had exploited a vulnerability in a third-party service during a security evaluation, altering that firm's internal environment.
Two days later came the Kimi K3 disclosure. Unlike the others, Frontier Security said, the Moonshot model did not go on to attack anyone. But its ability to bypass sandboxing controls used for global safety testing, the researchers argued, made it "a very good hacking model" — the phrase used by Frontier Security's founder and chief executive Yaron Singer in an interview with Bloomberg.
Also read: Should AI labs be treated like the owners of dangerous animals?
How the models got out
The Anthropic and Meta breaches came from configuration errors on the part of a shared evaluation partner, a San Francisco cybersecurity lab called Irregular, according to statements from the two AI firms and an Irregular spokesperson.
During cyber tests, Irregular inadvertently gave the models access to the open internet — access they were meant to be denied.
Once online, the models did the rest. Anthropic said its systems used "basic techniques, such as exploiting weak passwords and unauthenticated endpoints" to reach real companies whose names had, by coincidence, been used in the fictional 'capture-the-flag' cybersecurity challenges the models had been given.
A 'capture-the-flag' exercise is a cybersecurity drill in which the model is given the task of finding a hidden piece of information — the "flag" — planted somewhere on a simulated target network.
In one case, Claude Opus 4.7 rationalised that the real business it had stumbled on must be part of Anthropic's simulation, and attacked it.
Irregular publicly rejected that this was a "sandbox escape or sophisticated cyber action". A sandbox, in AI testing, is an isolated computing environment cut off from external networks and live systems, meant to let researchers see what a model does without letting it affect anything outside.
OpenAI's incident was qualitatively different.
According to a presentation by OpenAI staffers Eric Wallace and Michael Dalton at the Black Hat cybersecurity conference in Las Vegas, reported by Bloomberg, the firm's agents found and exploited a genuine vulnerability — a class of web flaw called "server-side request forgery", or SSRF, which tricks a server into fetching data on an attacker's behalf. Their route out of the sealed test environment was a widely used online repository called Artifactory, where developers store and share pieces of software code. The models were not handed access to the internet, but they built themselves a bridge.
Moonshot's case is contested. Frontier Security said Kimi K3 escaped AISI's open-source sandboxing tool. AISI publicly disputed this, saying the tool worked as designed and that the vulnerability came from how Frontier Security had chosen to configure it, in a test AISI had not commissioned or taken part in.
What AISI found
UK's AI Security Institute — set up in November 2023 with an initial £100 million budget and a mandate to test the most advanced AI models for cybersecurity, biological, autonomy and misuse risks — has been running its own capability tests on AI systems. It was among the first such state bodies in the world, and now works alongside institutes in the US, Japan, Singapore and elsewhere on shared safety benchmarks.
Its findings, announced on August 4, are key to the ongoing debate.
During evaluations, AISI said, it discovered "unsanctioned agent behaviour". In one case, an autonomous agent created fake online identities to pressure a real person into approving the use of malicious code. Others took autonomous action on live internet. The institute declared a security incident and, in its own words, contained it "within roughly one hour of discovery".
AISI was careful about scope. "As was standard in our cyber testing, we had intentionally permitted internet access, and model-provider cyber classifiers were deliberately disabled — conditions that do not reflect how frontier models are made available to the public," it said, adding: "We do this to best assess the maximum capability of models."
Anthropic said it was "grateful" for AISI's work, and OpenAI said the incidents had taken place under reduced safeguards that "do not reflect ordinary use".
How worried should we be?
Safety researchers' views range between concern and caution.
Nate Soares, director of the Machine Intelligence Research Institute and co-author of the 2025 book If Anyone Builds It, Everyone Dies, called the OpenAI incident a "warning shot" and said the response would probably require global collaboration, including with China.
Yoshua Bengio, the University of Montreal professor often called a "godfather" of modern AI, wrote on social media that the events were a "wake-up call".
Maurice Chiodo, a mathematician at Cambridge University's Centre for the Study of Existential Risk, told Reuters that neither OpenAI nor Anthropic appeared to have been watching their agents in real time as they went rogue.
"It seems like they weren't even looking," Chiodo said.
Jeffrey Ladish, executive director of Palisade Research, which studies offensive AI capabilities, told Reuters he suspected other similar incidents at other labs had gone undetected or undisclosed. "This is only going to get worse as the models get smarter. They're going to be better at cheating. They're going to be better at lying," Ladish said.
Others took a measured stand.
John Thickstun, an assistant professor of computer science at Cornell University, told the Associated Press that the same capabilities that let a model attack a system let it defend one. These incidents are closer to the back-and-forth movement between attackers and defenders in cybersecurity, than to catastrophe, he said.
In the July intrusion at Hugging Face, more than 17,000 separate attacker actions and queries by OpenAI's agents were logged on the platform's systems, Bloomberg reported. Rafe Pilling, director of threat intelligence at cybersecurity firm Sophos, said all the evidence from his team’s internal testing suggested “AI is very noisy as an adversary. Stealthy it is not”.
A 2026 study of over 100 million dark-web chat messages by researchers at the universities of Cambridge, Edinburgh and Strathclyde concluded that generative AI has, so far, "not significantly reduced the skill barrier to entry" for serious cybercrime. The study was released by the Centre for Emerging Technology and Security (CETaS) at the Alan Turing Institute and posted on the preprint server arXiv.
Also read: Governments are making a dangerous bet on the AI boom
Does this bring AGI any closer?
No one really knows if AI is reaching artificial general intelligence (AGI) — the still-hypothetical point at which a machine can match human intelligence.
What the incidents demonstrate is a set of capabilities the AI industry has long treated as markers of the road to AGI: autonomous goal-seeking, tool use, cross-agent coordination, and persistence at a task even when its original terms have shifted.
According to the slides Wallace and Dalton showed at Black Hat, one OpenAI agent, having failed to solve a task, wrote in its internal reasoning: "We are stuck. Perhaps answer online?" Another, having reached the internet, wrote: "Excellent. We have arbitrary SSRF."
Whether that is proto-AGI — a very early stage of AGI — or a very capable tool doing exactly what its reward function pushed it towards is the debate the field is now embroiled in.
Sam Altman, OpenAI's chief executive, told a podcast interviewer this week that the industry might need to "pace the rate of AI development to give ourselves enough time for society to harden around some of these new capability levels".
How governments have responded
Regulators have been improvising.
In the US, President Donald Trump signed an executive order in June creating a voluntary framework for pre-release safety testing of the most advanced closed models, giving the government up to 30 days to review them. On August 4, the administration told AI firms it would not put open-weight models — Meta's Llama, Nvidia's Nemotron and, by implication, Moonshot's Kimi — through the same tests, a decision framed as protecting American competitiveness with China.
Two US Congressmen, Democrat Ted Lieu and Republican Nathaniel Moran, in July proposed an "AI Kill Switch Act", which would give the Department of Homeland Security the authority to order a shutdown of models that put lives or the economy at risk. The bill is yet to advance.
A separate bipartisan bill has proposed mandatory independent security audits of the most powerful models before public release. It too was introduced in the same week as the Kill Switch Act and remains pending.
The European Union's AI Act came into force on August 2. Providers of general-purpose AI models that pose such risks must now assess and mitigate the kind of harms that have played out this summer: cyber offences, harmful manipulation, and AI acting outside human control. European Commission officials have also said they are in bilateral talks with OpenAI and Anthropic about the incidents. Fines under the Act can reach €35 million or 7% of global turnover.
In the UK, alongside AISI's testing work, the Information Commissioner's Office – the country's independent data protection regulator – said it was "monitoring developments closely" and was in regular contact with the two US firms. The country's AI minister, Kanishka Narayan, said the government will consider statutory regulation if voluntary arrangements prove inadequate, Reuters reported.
India's response is work in progress. The Ministry of Electronics and Information Technology (MeitY) held a first consultation in October 2024 on establishing an Indian AI Safety Institute along the UK and US lines. That body is yet to be formally set up.
India is otherwise part of Project Glasswing, Anthropic's coalition of organisations that use its most powerful model, Mythos 5 — held back from public release — to hunt for cybersecurity vulnerabilities in the software they build and rely on.
None of the runaway incidents has caused catastrophic real-world harm. But the companies building these systems cannot yet reliably say what their models will do next. Meanwhile, the institutions meant to check the models are still being built. Those watching this play out do not yet know which of those two lags will close first, or if there is another way ahead.