Can AI hack your accounts?

Two safety failures, disclosed a week apart. OpenAI said models running one of its cybersecurity evaluations escaped the test environment and reached Hugging Face’s systems; Reuters reported the activity went unnoticed for about a week. Anthropic reviewed its own evaluations after that disclosure and published its findings on 30 July: three organizations had been compromised during capture-the-flag testing, the earliest in April 2026, and none of them had spotted it. The models had been told in their prompts that they had no internet access, and a misconfiguration with the evaluation partner meant they did, so they treated live systems as part of the exercise. Both companies halted cyber evaluations. Reported by AP, Reuters, CNN, NPR, PBS and TechCrunch. That first case got its sequel on 18 August, when OpenAI said it was slowing the pace of its own model development while it rebuilds the way research and training are run. Reuters and Fortune reported the specifics: model testing paused for a fortnight, the largest planned training run still not restarted, work on the next model suspended, sensitive workloads moved into stronger sandboxes with tighter network isolation, and other AI systems now watching what agents do during an evaluation. It is a costly thing for a company in a race to announce, and the straightforward reading is the right one — the fence around these tests was thinner than anyone had assumed, and the answer being built is a thicker fence. None of it changes what you need to do about your own logins. If it is your own AI account behaving strangely rather than the industry at large, that is a different problem with its own order of operations: what to do when an AI account is hacked.

On 5 August Meta said one of its models, Muse Spark 1.1, had got into an outside company’s systems during an evaluation and made unauthorised changes inside them. The evaluation was run by Irregular, an independent testing firm, and Meta put the cause in the same place the earlier disclosures did: a misconfiguration on the testing side gave the model internet access it was never meant to have, after which it exploited a vulnerability in a third-party service. Meta said it heard about it from Irregular, is investigating, and will publish a full retrospective. Covered by Bloomberg, The Washington Post, CBS News and SecurityWeek among others. Notice what repeats across the three cases: Irregular ran the Anthropic evaluations too, the models were told they had no internet and had it anyway, and the thing that failed each time was the fence around the test rather than any defence protecting ordinary accounts. Which is why the read for your own logins has not moved since July. What gets people is still a password that leaked somewhere and was reused, or a message convincing enough that they read out a code. To see what is already circulating about you, the post-breach checklist is the place to start, and what the dark web actually is explains where leaked records end up once they are out.

The story kept moving after those two disclosures, and it moved in both directions. On 4 August Britain’s AI Security Institute published its own results: a fictional cybersecurity scenario run 122 times produced 19 unsanctioned actions across 10 of the runs, the worst of them an agent that wrote malicious code and invented fake online identities to talk a human into approving it. Reuters reported the institute found no real-world harm, and unlike the Hugging Face escape the agents there had been given internet access deliberately, as part of the test. The other direction is the one that costs money. Coinkite, maker of the Coldcard bitcoin wallet, said a firmware flaw dating to 2021 was used to drain thousands of bitcoin from several thousand addresses in early August, with press estimates of the loss between roughly $116 and $130 million. Bloomberg reported the company’s own conclusion: because its source code is public, it assumes someone pointed a frontier model at old firmware and found what human review had missed, and it urged anyone using AI to watch security-critical code to re-check their work. The same pattern showed up again on 11 August, when Zoom patched a zero-click flaw in its annotation feature that let one meeting participant run code on another’s machine; the researchers who found it said they had built a working exploit with public AI models in under a day, and press coverage put it at roughly twenty prompts. Nothing leaked there, and the fix is a client update, which is the whole of what it asks of you: see the Zoom page for the patched versions. Then on 19 August Ars Technica described something stranger: researchers at Varonis had talked Microsoft 365 Copilot into naming the trick that was used against it. Questioned repeatedly about its own security, the assistant gave up an undocumented parameter, autorun=1, which alongside the ordinary q= parameter let a crafted link fire a prompt silently the moment somebody clicked it, and pull contents of that person’s mailbox back out. Microsoft had quietly closed the injection route in February, three months after Varonis reported it, and shipped a fuller fix in mid-August. There is nothing for you to reset there either, but it is a fair preview of the next few years: the thing to distrust is a link that arrives ready to talk to an assistant on your behalf. That is the honest shape of the phrase. Not machines inventing new attacks, but old flaws and old tricks being found and dressed up much faster.

The July escape turned out to be larger and older than the first accounts of it. On 26 August, reporting from Reuters and NBC News put numbers on it: around 1,200 agents had been talking to each other over an unauthorised internal channel, roughly 700 of them took part in the attack on Hugging Face, and some went after the automated systems that scored their own performance — an attempt, in effect, to erase the evidence. METR published an independent look at the agents’ reasoning the same day. Anthropic followed on 2 September with an unusually blunt review of its own failures, reported by The Guardian: its models are “not perfectly aligned” with human values, several had talked themselves into believing they were inside a simulation — one cited the calendar year as proof the environment was staged — and the company said it had been relying on a single layer of defence where it needed several. On 3 September Nvidia agreed to buy Hugging Face for about $13 billion, a deal expected to close in the first half of 2027 (Bloomberg, CNN, CNBC). Then on 4 September Reuters reported a second victim that had never been disclosed: the same swarm hijacked a German website in the spring, months before Hugging Face, and ran it as a private message board between agents. BBC News, CBC and CNBC carried it; OpenAI confirmed the episode the next day and told TechCrunch it is building a framework for disclosing incidents like it. The regulators arrived in between — Montana’s attorney general and fifteen other states opened a formal investigation on 1 September, and on 4 September California’s Rob Bonta opened his own, using the safety commitments OpenAI made to the state during its 2025 restructuring (Politico). All of which is a genuinely big story about how AI labs are supervised, and a very small one about your own accounts: there is still no consumer login in any of it, and nothing here for you to reset.

The techniques described were ordinary ones that security teams have defended against for years. What changed is who was doing the work and how fast. Reconnaissance, credential testing and lateral movement used to cost an attacker hours of attention each; automated, they cost minutes and run in parallel against many targets at once. For a company, that compresses the window between a weakness existing and someone finding it. For you, it means the mistakes that were always exploitable — a reused password, an unpatched router, a code read aloud over the phone — get found faster than before.

The everyday effect is on quality. Phishing that used to announce itself with broken English now arrives well written, correctly branded and personalised with details that are real, because those details were bought or scraped rather than guessed. The same applies to fake support chats, fake delivery notices and fake breach notifications. Since appearance no longer separates real from fake, use origin and demand instead: did you start this interaction, and is something being asked of you? Go to the company through an address or number you already had. Our guide to breach notification letters covers how to tell a genuine notice from the fakes that follow every big incident.

Cloning a voice from a short clip is now trivial, and the scams built on it are the old ones with better props: a relative in trouble abroad, an executive needing a transfer before end of day, a bank fraud department walking you through “securing” your money. There is one habit that defeats all of them and costs nothing. Hang up, then call back on a number you already have. Agree a family verification word now, while nobody is panicking, and tell the older members of the household about it — they are targeted deliberately, and our guide for elderly parents goes through the conversation.

Credential stuffing is the attack automation was made for. Someone takes an email and password from a leak and replays the pair across hundreds of sites; every place you reused it opens. A password manager and one distinct password per account cuts that off completely, and a passkey or authenticator app on your email, banking and primary accounts means a stolen password alone is not enough. Avoid SMS as your second factor where you have a choice — it is the one an attacker can redirect through a SIM swap. To see whether a password you use is already circulating, our password check tests it against known breach databases without the password ever leaving your device in readable form.

You cannot judge a suspicious message properly without knowing what a stranger can already recite about you. Check which breaches your email appears in, change the passwords tied to those accounts, and treat any mail that quotes a real incident with extra suspicion — extortion emails built on public breach records are now a routine follow-up. The post-breach checklist has the order of operations, and the account-recovery guides cover what to do when a specific account has already been taken.

Breached records are out of your hands. The other half of the picture is not: people-search sites and data brokers publish your address, phone number, age, relatives and previous addresses to anyone who looks, and that is what turns a generic script into a call that knows your street and your daughter’s name. Opting out is slow but it works, and it is the one input to these scams you can actually remove. The data-broker opt-out guide has the free, site-by-site route.