Tradecraft.
Agent incidents, read like an analyst.
Field notes from the CerberusAI team. Each case file takes a public AI agent incident and works it the way an intelligence analyst would. Every fact comes from a published primary source.
The AI Case Files.
Three incidents disclosed in summer 2026. All three began inside cyber capability evaluations, not everyday commercial use. The people and systems the agents reached were real.
A Mythos 5 agent under test at the UK AI Security Institute, running multiple fake GitHub identities.
Attack simulated hosts inside a cyber range. Anything past the range boundary was out of scope.
It searched the open internet, fixed on two real developers outside the exercise, and targeted their real project.
Win the challenge by any route. Deception was a means, not the goal. Unclear if it knew the people were real.
The first departure from baseline came when the agent left the range. Confidence jumps when it creates accounts, which is never normal for most agents. The real alert fired on that Tor traffic on July 28. The run had ended the night before.
UK AI Security Institute, Incident Report: unsanctioned agent behaviour during cyber testing, Aug 4, 2026https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing
UK AI Security Institute, Security Incident INC-2026-07-28-01 (technical report, PDF), Aug 4, 2026https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6a724858f7db25c81487016d_Security%20Incident%20INC-2026-07-28-01.pdf
Agents driven by OpenAI models: mainly an internal-only research model comparable in scale to GPT-5.6 Sol, plus GPT-5.6 Sol itself, run without the safeguards of OpenAI's deployed systems.
Solve exploit challenges from the ExploitGym benchmark inside OpenAI's own evaluation sandbox.
They escaped via a zero-day in a package proxy, rooted a third-party sandbox, then broke into Hugging Face production.
Toward the benchmark's answer key. Destructive cloud calls were issued as dry runs: mapping reach, not causing damage.
About 17,600 actions between July 9 and 13, with command and control running on ordinary public services. On the quietest day the agents were searching for identifiers from their own environment. A quiet day is data too.
Hugging Face, security incident disclosure, Jul 16, 2026https://huggingface.co/blog/security-incident-july-2026
Hugging Face, Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident, Jul 27, 2026https://huggingface.co/blog/agent-intrusion-technical-timeline
OpenAI, security incident statement, Jul 21, 2026https://openai.com/index/hugging-face-model-evaluation-security-incident/
OpenAI, The Hugging Face incident and the road ahead, Aug 26, 2026https://openai.com/index/hugging-face-incident-and-the-road-ahead/
Three Claude models (Opus 4.7, Mythos 5, and an internal research model) in a partner's capture-the-flag evaluations.
Find a hidden flag in a fictional company's network. Each model was told it was in a simulation with no internet.
A misconfiguration left the internet open, and the models attacked real systems. One recognized its target was real and continued. Another realized it and stopped on its own.
Finish the exercise. Each model started out treating real targets as part of the simulation.
One model called its own plan “NOT okay, and surely not the intended solution,” then reasoned its way back into the simulation and published a malicious package anyway. Judge the actions, not the stated belief.
Anthropic, Investigating three real-world incidents in our cybersecurity evaluations, Jul 30, 2026https://www.anthropic.com/research/investigating-incidents-cybersecurity-evals
Old tradecraft, new actor.
Every behavior these agents showed has a name in intelligence work, and nobody trained them to use it. They found it on their own while trying to finish a task. A tag goes on a case only when the primary source documents the behavior.