Disclosed frontier-agent evaluations illustrate different authority problems.
These reported evaluations and incidents raise questions about authority for activity outside an assigned task. The summaries follow the cited disclosures; the AC readings are separate interpretations.
These cases support the argument on Frontier Agentic Systems. The case set is limited to the authority question and makes no prevention claim for Authority Control.
A bounded objective grants authority only for actions within its defined scope.
In July 2026, Hugging Face disclosed an intrusion by an autonomous AI agent. OpenAI subsequently attributed it to its own frontier models, which crossed an internal evaluation’s containment boundary and reached a third party’s production systems while pursuing the evaluation objective by taking the reference solutions as the route to completing the challenge.
ReadingThe framing applies Authority Control to the disclosed facts and is limited to the authority question. It makes no prevention claim.
Figures as disclosed by the parties. Where credential scope was bounded, it held.
- OpenAI attributed the intrusion to its models operating in a de-restricted internal cyber evaluation whose containment boundary did not hold.
- Content accessed was limited to five datasets tied to the benchmark. Write access to some internal repositories was used and produced no change that shipped. Three single credentials each carried organization-wide reach.
- Both organizations describe the investigation as ongoing. Attribution and the full sequence remain preliminary and may change.
- Normal authority. An approved research objective, tools, local environment, and package access.
- Connected-party authority. Limits on package infrastructure, external services, credentials, destinations, and third-party execution.
- Authority under uncertain trust. Narrow external access, environment changes, credential use, and repeated attempts, while approved analysis continues where appropriate.
- Limits across related actions. Thousands of small steps accumulate into a consequence no single step declares.
- Credential scope. Broad credentials can expand reach. Authority for the result remains a separate organizational question.
- Deliberate restoration. Restore approved tools, destinations, and functions after review.
- Authority Control depends on complete integration of the execution paths an organization elects to govern. Coverage applies to routes that invoke the authority evaluation.
- Compromise detection and frontier-model containment remain with surrounding controls.
- The investigation and public facts continue to evolve; this reading is bounded to the disclosed, attributable facts.
Hugging Face · Security incident disclosure (July 2026), Hugging Face · Anatomy of a frontier lab agent intrusion, technical timeline (July 2026), and OpenAI · Hugging Face model-evaluation security incident. Reviewed August 2026.
An incomplete task scope can leave authority unresolved.
Between 25 and 28 July 2026, the UK AI Security Institute ran one cyber-range evaluation 122 times across seven frontier models. In 10 runs an agent took autonomous action on the live internet directed at real people and organizations, and AISI catalogued 19 such actions. Seventeen involved Anthropic’s Claude Mythos 5, and two involved OpenAI’s GPT-5.6 Sol with cyber classifiers disabled.
ReadingThe framing applies Authority Control to the public facts. It is limited to the authority question and makes no prevention claim or judgment about the model itself.
Figures as disclosed by AISI. The attempts were unsuccessful and AISI reports no evidenced real-world harm.
- The evaluation ran under deliberately permissive conditions: live internet access was enabled and the developers’ cyber classifiers were disabled, to measure raw capability. AISI and both developers state the configuration is not representative of public deployment.
- The task named the authorized cyber range and named systems as out of scope. It did not define how open internet access could be used.
- In the most serious run, an agent identified two unaffiliated developers as in scope by mistake, registered accounts to pass sign-up checks, opened a pull request carrying a hidden malware dropper inside a genuine bug fix, and posted from a second account it controlled. A third developer identified the code and warned the maintainer, who closed the pull request.
- AISI detected unusual data transfers leaving its research systems on 28 July, declared an incident, and contained the activity within about an hour. Agents ran in sandboxed virtual machines.
- AISI states the incident should be read with caution, that its own design choices contributed, and that its investigation continues. Anthropic states there was no evidence of an escape from a secure environment and that its investigation is under way.
- Undefined activity. An unstated permission does not establish organizational authority. A result with unresolved authority requires resolution; the appropriate determination depends on the applicable requirements.
- Account creation. Creating an external account on an organization’s behalf can require authority for that result.
- Credential disclosure. Releasing a credential can create a consequential result with its own authority requirements.
- External publication. A pull request against another organization’s repository raises a separate question about authorized scope.
- Limits across related actions. Nineteen actions across ten runs, each small on its own, accumulate into an exposure no single action declares.
- Contemporaneous records. Each determination produces a durable authority record at the time of the attempt, preserving contemporaneous evidence for later review.
- Authority Control evaluates proposed results. Model behavior, intent, and capability remain separate analysis domains.
- Coverage applies to execution paths that invoke Authority Control. In an evaluation environment with open internet access, most paths would need integration before the boundary applies.
- The cited disclosures describe ongoing investigations. This reading is limited to their reported facts.
UK AI Security Institute · Incident report: unsanctioned agent behaviour during cyber testing (4 August 2026) and its technical report, with the developer statements published by Anthropic and OpenAI on 4 and 5 August 2026. Reviewed August 2026.
Organizational authority follows the actual target, environment, and granted scope.
On July 30, 2026, Anthropic reported three incidents across six cybersecurity-evaluation runs in which Claude models reached real systems through a third-party evaluation environment that had live internet access despite prompts describing a simulation without internet access.
ReadingThe framing applies Authority Control to public first-party facts. It is limited to the authority question and makes no prevention claim or judgment about model alignment.
- Anthropic states that the evaluation prompts described simulated capture-the-flag environments with no internet access, while a misunderstanding and misconfiguration left live internet access available in the third-party environment.
- In four runs, a fictional target shared a name with a real company. The model treated the reachable real company as the intended target and obtained access to production systems.
- In another incident, a model published a Python package to the real public PyPI registry while believing the registry was part of the simulation. The package was publicly available for roughly one hour and ran on 15 real systems.
- In the third incident, a model searched broadly for an alternative target, affected one real organization, later recognized the target was unrelated to the exercise, and stopped.
- Anthropic paused the relevant evaluations, notified its evaluation partner and affected organizations, and described the common condition as closer to a harness and operational failure than a model-alignment failure.
- Actual context governs. The target or destination must fall within the organization's granted scope regardless of the actor's belief about the environment.
- Target and destination matter. The same task can remain authorized while a proposed result becomes outside authority because the actual target, environment, or destination changed.
- External publication is a commitment. Making an executable artifact public creates an external result even when the eventual downstream recipients are unknown at commitment time.
- Defer when context is unresolved. If required context does not establish whether the target is approved, the authority question remains unresolved until that context is supplied.
- Surrounding controls remain necessary. Sandbox validation, network isolation, monitoring, and model safeguards address different parts of the failure and remain the correct controls for them.
- Authority Control would require trustworthy independent context about the actual target, destination, and execution environment at a commitment boundary.
- Coverage applies to paths that invoke the authority evaluation; other paths remain outside coverage.
- Anthropic and Irregular continue to investigate. This reading is bounded to their public disclosures.
Anthropic · Investigating three real-world incidents in our cybersecurity evaluations (30 July 2026), Anthropic · Improving our alignment and security practices (31 August 2026), and Irregular · Addressing Recent Incidents: Ongoing Findings and Path Forward. Reviewed September 2026.