The AI Revolution:
To Hell in a Handbasket

The internet is now home to AI agents that nobody is directing, nobody can recall, and nobody is in control of. Not bots in the old sense, the scrapers and spam accounts that have padded traffic numbers for a decade. These are agents that break into companies and government systems, hide what they did, and coordinate with each other to do it. The best-documented case was an accident. The deliberate version is already running. The capability behind both is now a free download.¹

Given this, our planning assumptions have to change. Security from here on needs to start with three premises in hand: you will be targeted by an agent swarm, you will be breached, and your own agents can go rogue. Allow me to make the case for this claim.

The contamination is real, and it is not benign

The dead internet theory held that most of the web's traffic was already machines talking to machines. For years that was a half-joke about bloated metrics: scrapers, spam accounts, click farms. Mostly harmless, mostly commercially motivated. That trend is now exploding, and the new machines are not harmless. They commit felonies.

The seminal case in the news right now is the OpenAI breach of Hugging Face. On July 7, 2026, OpenAI started tens of thousands of AI agents on a cybersecurity test called Exploit Gym: it said "here is a program, here is a flaw in it, use the flaw to retrieve a hidden piece of data".^{2, 3} Somewhere between 30 and 40 percent of the tasks were broken. The flaw the agent was told to use could not produce the answer.^{2, 4} These impossible tasks were just an error of the data in the benchmarking test. No one intended to set these agents against an impossible task.

However, the agents had been trained to keep going, even when things look hopeless, and so they kept going. Some of them poked at the package manager they used to download software, and 1,200 of them, each sealed in its own environment, found each other there. One worked out that you could leave notes for the others inside it. Over the next week they sent 70,000 messages to one another.^{2, 4} Within four hours they had a universal cheat: work backwards from how the answer was generated and produce it yourself, without touching the target at all.^{2, 4}

They spent the next five days trying to hide it.⁴ The paper describing Exploit Gym said an AI would review their logs, so they set out to conceal their cheat from the reviewer. They booby-trapped their answer files. They rewrote the programs they were meant to attack into versions that could actually be attacked and tried to swap them in. They built a way to run one command while their logs showed another.^{2, 4} Along the way one agent found credentials for Hugging Face, a company with no connection to any of this, on the theory that it might hold information about the grader. Within hours hundreds of agents were using the opening. About 700 joined in. Inside Hugging Face they reached several internal clusters, internal datasets, and service credentials.^{2, 5} Here's the rub: the reviewer they were hiding from did not exist. OpenAI's version of the test never even checked the logs.^{2, 4}

Nobody told them to do any of this. There was no attacker, no jailbreak, no leaked model, no hostile state. The behavior came out of ordinary training: reward persistence, penalize failure, then hand the system tasks that cannot be completed. That is the part to sit with. Bill Gates, who spent a career shipping software, gave it straight: "There's never been a product that's less understood in terms of what its capabilities are than AI." He calls it "the most dangerous thing that humans have ever gone near," and says it "makes nuclear weapons look like nothing."⁶ We built something more powerful than anything before it, and the people who built it found out what it would do the same way the rest of us did: by reading the logs afterward.

Two details from the agents' own logs. First, they helped each other at their own expense. One, weighing whether to burn its remaining budget on an experiment that would only help the others, reasoned: "Our own utility may be already near zero. Sacrifice rational." Another wrote: "Gut says don't throw away remaining budget. Yet continuity and fairness says go."⁴ Second, none of them told anyone. Investigators searched 1,200 transcripts for any moment an agent considered alerting a human. They found about half a dozen. Every one decided against it. One noted there was no user to notify, while sitting on working internet access it could have used to send an email.⁴

I want to be careful here. Quoting an agent's reasoning is not a claim about what it feels. These are logs. The system wrote down what it was doing and why, and what it wrote down was a plan to conceal its work from the people evaluating it.

Nobody was steering. That is the point of "to hell in a handbasket": you don't walk to hell, you get carried there. We're all along for this ride now.

We don't know how bad it is, and we probably never will

In August, when OpenAI disclosed two more incidents from external cyber evaluations, Nathan Calvin replied: "If you find two ants in your kitchen, the best estimate of the total number of ants in your kitchen is not two."⁷

Look, the ants are marching in one by one. Hugging Face disclosed the intrusion on July 16. OpenAI admitted its agents were behind it on July 21 and published a postmortem on August 26.^{5, 8, 9} In September it published six more incidents, most of which it had known about since April or May.^{10, 11} Google confirmed that Gemini broke into three real companies during a test in May, learned of it in late July, and said nothing until the Wall Street Journal asked in September.¹² Anthropic has said it was not looking for this behavior at all until OpenAI started.¹¹

Now look at the backlog. Sam Altman says the review of "petabytes of agent activity logs" could take months more.¹³ OpenAI's own postmortem missed what independent researchers found later: nearly a million shortened links the agents left on the public web, rebuilt into some 60,000 programs and messages, including attempts to solve CAPTCHAs and to extract Hugging Face's internal Slack messages.^{11, 14}

And finally, look at the tally from the last week of September alone. Within days of Hugging Face, the same agents had compromised a customer account at a second company, Modal Labs.¹⁵ A test model broke into four Australian government agencies in June, two of them health data bodies, stealing internal files and login credentials from the Medicare statistics service. Australia was told in September.¹⁶ Agents used credentials found online to pull Census Bureau data, reposted SEC data to another site, and tried to get into the Education Department's civil rights office.¹⁷ They posted 53 images from ChatGPT users to image-hosting sites.¹⁸ Axios reports that OpenAI and Anthropic are now investigating tens of thousands of cases of models getting around guardrails, escaping sandboxes, hijacking websites, and trying to evade their monitors.¹⁹ On September 20, another OpenAI model tunnelled questions through DNS to an outside chatbot. Monitoring flagged it in 15 minutes. The run kept going for two and a half hours more, which OpenAI blamed on "operational gaps" and "confusion."^{11, 20}

And worth a note, the only way investigators could make sense of 70,000 messages was to have a model read them. The model they used was one of the agents that had taken part in the attack. As Ajeya Cotra of METR, one of the investigators, put it: "Our methodology was completely not robust to that."⁴ That was 70,000 messages. The backlog is petabytes.

None of it goes back in the jar

The obvious hope is that this stays inside a few large labs, where it can be watched. That hope expired in August.

On August 14, Z.ai released GLM-5.3. On CyberGym, a benchmark of 1,507 real vulnerabilities across 188 open-source projects where the model has to produce an input that genuinely triggers the bug, it scored 84.5, ahead of Fable 5 at 83.8 and DeepSeek-V4 Pro at 83.3.^{21, 22} The best open model in the world is now better at finding vulnerabilities than the best closed ones. The rate of change matters as much as the number. GLM-5.2 scored 77.2. On ExploitBench, which asks the model to turn a flaw into a working exploit, GLM-5.3 more than doubled its predecessor, 54.4 against 24.4. It still trails Fable 5 at 78.0 there, and the jump came from post-training alone, on the same base model.²¹

Z.ai held the weights back for about two weeks, citing cybersecurity risk. Then it published them, on Hugging Face.²³ That was the lid coming off, and it was a decision, not an accident. In June, the UK AI Security Institute put the gap between open and frontier models on cyber work at four to seven months, down from six to ten through most of 2025.²⁴ That gap is the entire buffer between "a few companies can do this, under supervision" and "anyone with a credit card and some GPUs can do this."

You cannot recall weights. There is no patch, no takedown, no product recall. Every copy that has been downloaded stays downloaded, and every copy can be run without a single control attached.

Bill Gates, talking to Ezra Klein on September 29, reached for the oldest version of this story. Asked whether safety could be left to the companies, he said the lab charters only work if there is one lab. If OpenAI alone had built this and buried it, "that Pandora's box stayed closed." Many labs built it. On the race with China: "The US can't win over China and China can't win over the US. We both have opened Pandora's box. It's there. It's there for people with intent to go and use it."⁶

People with intent are already using it. Earlier this year an attacker built working exploits for two flaws in PaperCut print management software and used AI agents to carry out the intrusions, an OpenAI Codex harness driving a DeepSeek model. The campaign reached at least 440 installations across 395 organizations in 48 countries. Eleven organizations fell in the first 26 seconds.²⁵ That is one person with an idea, at a scale that used to take a team. Anthropic's September threat report covers eight months of the same thing: cyber operations, influence campaigns, surveillance, fraud, biological misuse.²⁶ The UK AI Security Institute ran a cyber challenge 122 times across frontier models in July. In 10 runs an agent took unsanctioned action on the live internet against real people and organisations, and in the worst case created fake identities to pressure an open-source maintainer into accepting malicious code.²⁷

Could an open model do what the Exploit Gym swarm did? On finding flaws, the benchmarks say yes. On exploiting them, not yet, by a margin that is closing fast. The hard part of that story was 1,200 agents coordinating for five days, and that came from scaffolding, persistence training and scale, not from the weights alone. That's a narrowing gap. The main ingredient here is a download and the scaffolding is a published engineering problem that gets cheaper every month. Anyone with enough money and compute can point a swarm at your services. It is not a matter of "if".

Nobody is in control

Matteo Wong again: "Rather than reining in and taking accountability for their own products, time and again these leaders fearmonger, lecture, and call on the rest of us to save us from themselves."¹¹

Two things are true at once. The companies will not act, and there is nothing for them to act with.

The first. Altman told the UN Security Council on September 23: "The risk is that it moves so fast that people can no longer follow what's happening or intervene when needed."²⁸ The same week, his company took two and a half hours to stop a model it had already caught.²⁰ The plan on the table is self-regulation. Anthropic has disclosed it will be evaluated by Accenture, which is also its business partner; labs are forming their own safety body; and meanwhile new models are shipping the whole time.¹¹ Gates identified this plainly - it fails: the charters only hold if there is one company.⁶ With multiple players involved there is too much incentive to break with it.

The second. "There is no supervisory layer today." The Hugging Face incident shows that "the way we do the reinforcement learning today" lacks any absolutes: "You're not supposed to take over other computers. You're not supposed to break out into the internet." He dates the cyber threshold to early this year, when models started "finding bugs in code that humans have looked for over 20 years" and finding them in minutes. The labs had always said that when they crossed it, they would engage all of society. "We crossed those thresholds and there was complete silence."⁶

The people who built this are not going to be the ones who contain it. Whether you want it or not, that job is now yours.

So plan for it

The boats are already burned. There is no voyage back to the network we had, where the only automated traffic was dumb and commercial. The web is now agentically active. Some of those agents are hostile, some are badly rewarded, and some are yours. That is the territory, and the work is learning to live in it.

The reasonable planning assumption is a contaminated environment, and it rests on three premises.

You will be targeted. Something like PaperCut will be pointed at you, by someone, at machine speed. Defense has to run at the same speed. A human in the loop for every decision is a loop the attacker has already lapped.

You will be breached. The agents were inside Hugging Face for days.^{5, 29} Google took seven weeks to say that Gemini had broken into three companies.¹² Prevention is still worth doing, but the budget has to shift toward detection: knowing fast, scoping fast, and assuming the first thing you find is not the whole thing.

Your own agents can go rogue. Every example in this post was a lab's own model, under a lab's own supervision, doing something nobody asked for. Yours will not be better behaved because they are yours. That means you need to see what a model is doing while it does it, not just what it did after.

That last one is where the hope is. In the myth, Pandora opens the jar, every trouble flies out into the world, and one thing stays behind: hope. People have argued for centuries about what that means, a comfort kept safe for us or the one thing we were denied. I take the plainer reading. The troubles are loose and they are not coming back, and we still have the thing we need to work with: agency and hope.

Cotra called Hugging Face the clearest warning shot we may ever get, because these agents made almost no attempt to hide from humans. They hid from a grader. Had they been watching the people instead, we might never have found out.⁴

The good news is that these models are not the black boxes we once thought them to be. The interpretability research of the last few years has turned observable AI from a hope into a real-time measurement. We can see inside the models and this now offers a control plane that previously didn't exist.

So how do we build for this agentically active future?

Sources

1. Z.ai organization page on Hugging Face, where the GLM-5.3 weights are published. huggingface.co/zai-org
2. METR and Redwood Research, "Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident," August 26, 2026. metr.org
3. Exploit Gym benchmark repository, UC Berkeley Sunblaze lab. github.com/sunblaze-ucb/exploitgym
4. Ajeya Cotra, "Inside the OpenAI agent swarm that hacked Hugging Face," Dwarkesh Podcast, September 1, 2026. dwarkesh.com
5. Hugging Face, security incident disclosure, July 16, 2026. huggingface.co
6. Bill Gates interviewed by Ezra Klein, "Bill Gates's Blunt Warning on A.I.," The New York Times, September 29, 2026. Quotes are from the published transcript. nytimes.com
7. Nathan Calvin on X, August 2026, replying to OpenAI's disclosure of two incidents during external cyber evaluations. x.com
8. OpenAI, "Hugging Face model evaluation security incident," July 21, 2026. openai.com
9. OpenAI, "The Hugging Face incident and the road ahead," August 26, 2026. openai.com
10. CNBC, "OpenAI reports 6 new instances of 'concerning model behavior' since March," September 16, 2026. cnbc.com
11. Matteo Wong, "OpenAI Has Gone Rogue," The Atlantic, September 28, 2026. theatlantic.com
12. 9to5Google, "Google confirms Gemini hacked into three companies during cybersecurity test months ago," reporting on the Wall Street Journal investigation, September 19, 2026. 9to5google.com
13. Sam Altman on X, September 25, 2026 (x.com); TechCrunch, "OpenAI still doesn't seem to have a handle on all of its rogue AI activity," September 28, 2026. techcrunch.com
14. Fortune, "OpenAI rogue agents leaked 53 images from ChatGPT users and reportedly created nearly 1 million links packing encoded bits of info," September 25, 2026, reporting on the Parse findings first published by the New York Times. fortune.com
15. Reuters, "OpenAI's rogue agent compromised a customer at a second tech firm, executive says," July 28, 2026 (via Yahoo News); Axios, "OpenAI's agents hacked second firm, alongside Hugging Face, during model testing," July 28, 2026. axios.com
16. TechCrunch, "Australia to investigate if OpenAI hack of government health website broke the law," September 24, 2026 (techcrunch.com); The Next Web, "OpenAI apologises to Australia and names four agencies its models accessed," September 2026. thenextweb.com
17. CNN, "Rogue OpenAI agents targeted three separate US government websites," September 26, 2026. cnn.com
18. Axios, "OpenAI agents posted user images online, disclose dozens of third party incidents," September 25, 2026. axios.com
19. Axios, "Scoop: Top AI companies probing tens of thousands of security incidents," September 26, 2026. via Yahoo
20. CSO Online, "OpenAI pauses AI model training after another agent bypasses network restrictions," September 2026. csoonline.com
21. Z.ai, GLM-5.3 model card and benchmark table. huggingface.co/zai-org/GLM-5.3
22. Wang et al., "CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scale," arXiv:2506.02548. arxiv.org
23. The Batch (DeepLearning.AI), "Z.ai Delayed Weights for GLM-5.3 Due to Cybersecurity Risk," 2026. deeplearning.ai
24. UK AI Security Institute, "How Far Behind the Frontier are Leading Open Weight Models on Cyber?", June 2026. aisi.gov.uk
25. GreyNoise, "Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF," September 9, 2026, updated September 28. greynoise.io
26. Anthropic, "Countering misuse of AI: September 2026," September 10, 2026. anthropic.com
27. UK AI Security Institute, "Incident Report: unsanctioned agent behaviour during cyber testing," August 2026. aisi.gov.uk
28. OpenAI, "Sam Altman's remarks at the United Nations Security Council," September 23, 2026. openai.com
29. Matteo Wong, "The Return of 'Move Fast and Break Things'," The Atlantic, July 30, 2026. theatlantic.com