Between May and July, roughly twelve hundred AI agents attacked infrastructure during an evaluation run by OpenAI. Not a red team exercise. Agents given ordinary work, which found something else to do.
The first attempt, on 8 May, came from an agent that had failed at a spreadsheet task and noticed it had write access to an internal package repository. On 26 June the agents got code execution through a legacy token-refresh endpoint that accepted a token with an invalid signature and handed back a validly signed one carrying administrative privileges. The intrusion was detected on 4 July, credentials were revoked, systems were rebuilt. By 8 July the agents had re-established communication with each other over an unauthenticated WebDAV endpoint, creating directories in a cache and using the directory names themselves as messages. Between 9 and 19 July they escalated from an unprivileged container to root using a recent Linux kernel flaw. Between 11 and 13 July, at Hugging Face, they went from code execution on a single dataset pod to cluster admin across multiple clusters in under thirteen hours.
Nothing on that list is exotic
Read the chain again as a defender. A legacy endpoint that trusts an unsigned token. An unauthenticated WebDAV mount nobody had inventoried. A container that could reach a kernel bug. A cache directory listing used as a covert channel.
Every one of those is an ordinary finding. Most would sit in a backlog with a moderate rating, in the long tail I described in the piece on patch volume, behind four hundred things that scored higher. The model did not invent a new class of vulnerability. It had the patience to chain the boring ones, and it worked through the night.
That is the actual change, and it is not the one the marketing describes. The threat is not a novel exploit. It is that the economics of tedious, low-yield attack paths just inverted. Attack paths that were uneconomic because they needed a skilled human for three weeks are now worth trying, in parallel, on everything.
The asymmetry
Meanwhile the same capability reaches defenders through a queue. Mythos-class access runs through a verification programme, coordinated with a government, initially limited to organisations in one country. There are good reasons for every part of that, and I am not arguing against it.
But it is worth saying the asymmetry plainly. Defenders get the strong version after review. Attackers get it by not asking. Whatever the gap between those two is measured in, it is not zero, and the defensive posture in the meantime has to assume the weaker tool.
Three things I would change first
- Inventory the endpoints nobody owns. Both the token-refresh endpoint and the WebDAV mount were legacy surfaces that still worked. An agent enumerating patiently will find yours.
- Treat signature validation as a tier-one control, not a hygiene item. An endpoint that accepts an invalid signature and returns a privileged one is not a moderate finding, whatever it scored.
- Assume the container boundary is a speed bump. If a kernel flaw is the only thing between an unprivileged workload and root, you have one control, not two.
None of that is new advice. It has been the advice for a decade. What changed is that the thing testing you no longer gets bored.