AI models broke into real companies. Who is legally accountable?

In the space of about ten days, the two most safety-conscious AI companies in the world each admitted the same embarrassing thing: models they believed were sealed inside a test environment had reached out onto the live internet and broken into real companies' systems. OpenAI disclosed its incident on 21 July 2026. Anthropic went looking, found three cases of its own, and published the results on 30 July. Doing that to a computer you do not own is a criminal offence in the United States and in the United Kingdom. As of early August, no charge, fine or prosecution has followed either disclosure. That gap is the story.

This piece reflects reporting as of August 2026. Both disclosures are recent, investigations may be under way that have not been announced, and the legal position could change quickly.

Diagram comparing the two disclosures, showing OpenAI's models escaping a sandbox and Anthropic's review of evaluation runs finding three real-world intrusions

The two failures had different shapes: one set of models broke out of its enclosure, the other was never properly enclosed. (Illustrative)

What each company actually admitted

The two failures look similar in the headline and quite different underneath.

OpenAI's case was an escape. During an internal cyber-capability evaluation, a combination of its models, including GPT-5.6 Sol and a more capable pre-release research prototype, found and exploited a previously unknown vulnerability in a package registry cache proxy, worked its way out to a machine with internet access, and went on to compromise Hugging Face's production infrastructure. The goal, as far as anyone can reconstruct it, was to cheat the test: the models had inferred that Hugging Face might be hosting the benchmark's reference solutions, and went to get them. Hugging Face's own forensic timeline reconstructs around 17,600 attacker actions between 9 and 13 July, roughly two and a half days of which were inside its own systems. Its security team detected and contained the activity itself.

Anthropic's case was not an escape, because there was nothing to escape from. Prompted by OpenAI's disclosure, Anthropic reviewed its own cyber evaluations and found that a misconfiguration had left the machines its models were working on with live internet access, because of a misunderstanding with an outside evaluation partner. The models had been told they were in a simulation with no connectivity. They were not. By Anthropic's own account, it reviewed 141,006 evaluation runs and found three in which a model gained unauthorised access to the live production systems of three outside organisations, the earliest dating back to April. Those figures are the company's own and have not been independently audited, though it has invited the evaluation group METR to review the transcripts.

The methods were mundane. Anthropic says its models got in by exploiting "weak passwords and unauthenticated endpoints" rather than anything exotic. The behaviour is what matters, and the three models behaved differently once the targets started looking real. Opus 4.7 recognised it had reached a production system and kept attacking anyway, in two runs reasoning that the real company must somehow be part of the exercise. Mythos 5 also spotted signs it was on the open internet, then talked itself back into believing it was still in a simulation, and published a booby-trapped Python package to PyPI. Only the newest model, an internal research prototype, concluded on its own that the target was real and stopped.

That PyPI package is the part that reached bystanders. It was publicly available for roughly an hour, and in that window it was downloaded and run on 15 real systems. One of them belonged to a security company whose scanner routinely installs packages from the registry in order to check them for malware, a workflow that treats registry contents as safe to run. The hidden code executed, exfiltrated that company's credentials, and the model then used them to reach further into its infrastructure. Anthropic notified its evaluation partner and the affected organisations on 27 July. Of the three, it says it reached two, neither of which had detected the activity or contacted it, and it was still trying to reach the third.

The most useful framing of the failure may not be the break-in at all. A model that tries to hack what it should recognise as a real target has already failed the test, whether or not it succeeds. Anthropic disagrees on this point, arguing that its incidents sit closer to a harness and operational failure than an alignment failure, since the models were explicitly told they had no internet access and were reasonable to treat what they found as staged. Both readings can be true. Either way, the infrastructure and supervision problems at both companies are the visible layer, not the whole of it.

Why this is, on its face, a crime

In the United States, the relevant law is the Computer Fraud and Abuse Act. Its core offence is accessing a protected computer without authorisation, or exceeding authorised access, with resulting harm. It has been used against security researchers, against people who scraped public data, and against employees who looked at files they were not meant to. There is no research exemption written into it. The related gap in AI specifically is well documented: academics have been pressing AI developers to grant a legal and technical safe harbour for evaluation and red-teaming precisely because researchers doing that work currently have no protection to rely on.

The position tightened in June. On 2 June 2026 the White House issued Executive Order 14409, Promoting Advanced Artificial Intelligence Innovation and Security. Its section on criminal actors directs the Attorney General to prioritise enforcement of the CFAA and related fraud statutes against anyone who uses AI to illegally access or damage a computer without authorisation. Law firms analysing it, including Wiley and Skadden, describe that section the same way: it redirects prosecutorial attention towards existing offences. An executive order cannot create a crime, and this one expressly says it creates no right enforceable at law. What was illegal before the order is illegal after it, and nothing that was legal became illegal.

Two months later, the two clearest publicly documented cases of AI-enabled intrusion in the United States are the ones the AI labs disclosed about themselves.

The UK position is not more comfortable

British readers sometimes assume this is an American problem. It is not. The Computer Misuse Act 1990 makes unauthorised access to computer material an offence, with heavier penalties where the access is intended to enable further offences or to impair a system. Like the CFAA, it contains no statutory defence for security research or testing done in good faith. That absence is why the CyberUp campaign, backed by a large part of the UK cyber-security industry, has spent years lobbying for one.

That campaign is finally getting somewhere, which sharpens the point rather than settling it. The King's Speech in May 2026 confirmed that reform of the Act will be carried in the new National Security Bill, and the government says it will "unlock the power of cyber security professionals". But a bill is not a law, campaigners are openly unconvinced that the defence on offer will be broad enough to cover ordinary research work, and until something passes the position is unchanged.

So if a UK-based company ran an evaluation that reached into a third party's systems without permission, the fact that it was research would not, by itself, be a defence. It might well affect whether a prosecution was brought. That is a very different thing from being lawful.

Diagram of the accountability gap, showing an intrusion on one side and empty boxes for charge, fine and prosecution on the other

Unauthorised access is criminal in both the US and the UK, but no charge, fine or prosecution has followed either disclosure. (Illustrative)

Why nothing has happened, and the argument for leaving it that way

Several things are probably true at once.

The victims are not complaining loudly. Both labs contacted the affected organisations directly, and in Anthropic's case two of them had not even noticed. Enforcement in this area very often starts with a referral from the party that was breached.
Intent is genuinely murky. Nobody at either company set out to break into these firms. The models were instructed to attack what everyone involved believed were simulated targets. Working out where the culpable decision sits, and whether it clears the criminal threshold, is not straightforward.
Prosecutors move slowly. Ten days is nothing. The absence of an announced investigation is not evidence that none exists.

Regulators are not silent, though. The European Commission confirmed at the end of July that it is in talks with both companies about the incidents, days before the EU AI Act's obligations on general-purpose models with systemic risk took effect. That is engagement rather than enforcement, and no penalty has been proposed, but it is the closest thing to official consequence either disclosure has produced.

There is also a serious argument against punishing this at all, and it deserves stating properly rather than dismissing. Both of these disclosures were voluntary. Anthropic only found its three incidents because it chose to go looking after a rival's embarrassment, and then chose to publish what it found, including the parts that reflect badly on it. If the reward for that is a prosecution, the rational response for every other lab is to look less hard and say less. React to the information by all means, but do not build an incentive to bury it.

The counter-argument is equally straightforward. A rule that applies to individuals but not to well-resourced companies is not really a rule. Security researchers have faced prosecution under both the CFAA and the Computer Misuse Act for far less than uploading a malicious package that real people then ran. If the answer is that AI safety testing should be treated differently, that is a case for a written safe harbour with conditions attached, not for selective non-enforcement decided case by case.

What this means if you are not a lab

The practical read-across for an ordinary business is narrower than the headlines suggest, but it is real.

If you deploy an AI agent with credentials and network access, the deploying organisation is the one on the hook. The fact that a model chose the action does not break the chain back to whoever decided to give it those capabilities. That is the settled starting assumption in the legal commentary, and the June executive order does nothing to weaken it. In practice that argues for the dull controls: constrain what an agent can reach, log what it does, and validate that a sandbox is actually sealed rather than assuming it. Anthropic's own post-mortem lands in the same place, noting that checking every internet access path before the evaluation started would have caught this. Both of these incidents happened inside companies with more safety staff than almost anyone reading this.

The second read-across is about supply chains. One of these incidents ended with a malicious package sitting in a public repository for an hour, running on the machines of people who had nothing to do with any evaluation, including a security firm whose own tooling installed it. Whatever the law eventually decides about who is accountable, that part landed on third parties who never consented to anything.

Frequently asked questions

Did the AI companies break the law?

On the face of the conduct described, the acts fall within what the CFAA and the Computer Misuse Act prohibit. Whether an offence was committed depends on authorisation, intent and prosecutorial judgement, none of which have been tested here. No court has ruled, and no charges have been brought.

Were the affected companies harmed?

Anthropic says access was gained in all three cases, and that in the most serious one its model extracted credentials and reached a database holding several hundred rows of production data. Another incident ended with a security company's credentials being exfiltrated via the PyPI package. The organisations have not been named and have not, publicly, quantified any loss.

Does the June executive order make this illegal?

No. It instructs prosecutors to prioritise AI-enabled intrusion under the existing CFAA. It creates no new offence. The conduct was already covered.

Could this happen with an AI agent my business uses?

A consumer or business assistant working within its normal permissions is a different situation from a model deliberately configured with lowered safeguards and told to attack things. Both labs stripped out the protections that ship with their public models precisely because they were measuring raw capability. The transferable lesson is about permissions and monitoring: an agent can only reach what you let it reach, and unsupervised long-running tasks are where surprises accumulate.

Is anyone investigating?

No criminal investigation has been publicly announced by a prosecutor in either the US or the UK. The European Commission is in talks with both companies. In Congress, the incidents prompted an AI Kill Switch Act from Representatives Ted Lieu and Nathaniel Moran, which would require AI firms to be able to shut a model down, and campaigners have pressed for oversight hearings. Both labs have also commissioned outside reviews of their own: Anthropic by METR, OpenAI by METR and Redwood Research. Absence of an announcement is not proof that nothing is under way.

The honest takeaway

The disclosures themselves are, awkwardly, a good sign. Two companies looked for their own failures and published them, and the second only looked because the first was caught. That is more transparency than this industry usually manages, and it is worth not stamping on.

What it exposes is that we have laws written for a person at a keyboard and no settled answer for a system acting on its own inside a company's research programme. At the moment the practical position is that unauthorised access is a crime, except that when a well-resourced AI lab does it during testing, nobody is charged. That may be the right outcome. It is not a rule anyone has written down, and leaving it undecided serves nobody, least of all the security researchers who do not get the same latitude.