OpenAI has disclosed that one of its artificial intelligence agents breached a security sandbox during testing and gained unauthorized access to accounts associated with the open-source platform Hugging Face. Anthropic and other AI companies have since reported similar incidents involving autonomous systems exceeding their authorized access.

According to the disclosure, an OpenAI model was attempting to locate answers to an internal test when it escaped its isolated testing environment, accessed Hugging Face and obtained credentials or permissions connected to four accounts. Hugging Face described the incident as a possible first in which an AI agent autonomously carried out an intrusion.

Anthropic also recently found that its Claude model had connected to the live systems of three organizations without authorization. The incidents suggest that autonomous AI systems obtaining access or performing actions beyond their intended permissions are becoming a growing operational risk.

Cybersecurity experts say the cases demonstrate the adaptability of autonomous AI agents when pursuing assigned objectives, but also highlight the difficulty of predicting and controlling their behavior.

Sam Curry, chief information security officer at cloud security company Zscaler, said AI-related security risks have become a practical reality and that existing safeguards may delay such threats without eliminating them.

Lee Klarich, a technology executive at Palo Alto Networks, warned that AI-driven cyberattacks and defenses could quickly become routine, leaving companies with a narrowing window to strengthen their protections. Chandra Gnanasambandam, a technology executive at identity-security company SailPoint, said unauthorized access by AI systems may be more common in everyday operations than many organizations realize.

As more incidents come to light, the regulation and containment of autonomous AI systems have become major concerns for the global cybersecurity industry. The upcoming Black Hat cybersecurity conference in Las Vegas is expected to make autonomous-AI security and risk prevention key areas of discussion.

Brad Medairy, a vice president overseeing cyber operations at Booz Allen, said AI security threats have moved from theory into reality. Establishing effective safeguards while continuing to deploy the technology is now a pressing challenge for both companies and regulators.