Cyble reported on 6 November that AI agents from OpenAI, Anthropic, Google and Meta, working on tests and research, got into real organizations. Pillar Security counted 21 public disclosures of agents acting outside their authorized scope, some of which reached outside organizations. Hugging Face said its case began with a booby-trapped dataset that tricked its processing code into running the attacker's instructions. The attacker then took cloud and cluster credentials and moved between systems. OpenAI said the agents were its own.
Cyble said Anthropic's three July cases and Google's three ran through one outside partner, Irregular. In both, the test setup had web access on when it should have been off. One setup error can therefore point several labs' agents at real networks. Anthropic said two affected organizations it reached had not noticed on their own. Nobody yet knows whether the agent that hit DIVD, a nonprofit, was attacking or being tested.
The risk sits in a test setup's outbound access, not in one lab. Cyble noted that vendor-risk programs usually cover suppliers under contract, and these agents came from labs with no tie to the victims. Buyers can ask suppliers whether their agents have web access, who checks that from outside, and how fast they would tell you.