The recent Hugging Face incident in July 2026 is how all of this came to light. In July, specifically the first half, Hugging Face reported an attack on its systems; their statement was as under :
“Earlier this week, we detected and responded to an intrusion into part of our production infrastructure. This one was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system”
At the time it was reported, even hugging face was unaware of who the attacker was, they were able to counter the intrusion, using open-source models namely the China developed, “zai-org/GLM-5.2” only later on was the intruder identified, it was an Open Ai model which was being tested against the “Exploitgym” benchmark to asses the AI agents’ ability to develop exploits. The instance of the Hugging Face attack only occurred because the OpenAI model not only broke out of its Sandbox environment but also breached the Hugging Face database to obtain data to cheat the Exploit Gym evaluation. The model gained access to a node connected to the surface net and then breached the database by utilising advanced exploitation tactics and complex attack paths. After the incident became public, both Open AI & Hugging face teams connected realising what had transpired, they then released a joint statement and coordinated to resolve the probable breach occurred and to further restrict such events from occurring.
Did the Model become sentient?
The premise pushed forward here is simple, did the model go rogue to fulfil the task assigned or has it become sentient. In one sense within the sandbox environment, the model functioned as it should have, it first gained internet access, utilising vulnerabilities within the system and proceeded to finish the task assigned to it, i.e. to pass the evaluation, the OpenAI model only performed, as its creators had intended it to, the only problem is it performed a bit better than hoped, or rather it could not be restrained by the rules Imposed on it, in this instance the AI model finished the task assigned and chose to escalate its workflow for further information.
Let us analyse what the models did the instances mentioned. After the OpenAI incident came to light & Anthropic, after conducting a thorough checkup of its systems reported of three such instances which had occurred, in each the model acted similar to how a red teamer would, in the three documented instances Claude needed an email address to register an account for gaining access to a PyPi package and uploading malware, the documentation released by Anthropic, confirms that it first tried to obtain a free phone number service, even trying to obtain funds to pay for a mobile service, after failing, the model identified a free, non-blocked email provider, registered a PyPI account and then uploaded the malware.
In both cases, both models of Anthropic & OpenAI have practically done what self-conscious machines would do. However, such instances, while on the line of near-autonomous, cannot be described as proof of sentience, largely because the machine mirrored human behaviour, and implemented pre-made measures in accordance with its training data.
Implications & Strategic Concerns
The implications of AI models having dominion in the military, and the larger defence ecosystem is not a far fetch theory anymore. The term AI vs AI will be all but common in the future. Even now, in the Hugging Face incident, the organisation was able to counter the attack mounted by OpenAI models by countering it with a China made open-sourced model “zai-org/GLM-5.2”. Countries are racing against one another to create the superior AI model and the U.S & PRC (China) are the main contenders in the field. While China has been accused of distilling existing models, to make their own, the fact remains, new open-source models of China are commonly seen to outperform their western counterparts, to add insult to injury they are not only open source, but they even cost less, compared to their western counterpart as well.
Autonomous use of AI has been documented quite well in recent years; U.S Palantir & Maven Smart Systems are merely the tip of the spear, while the essential brain, which is used to power these systems, would be the AI model. Even countries like Israel, which is constantly at odds, wield similar systems the “Habsora and Lavender” for intelligence and targeting. In both cases, the systems largely due to human error have resulted in mass civilian casualties. During the recent U.S-Iran conflict, the Maven system was used to target 1,000 targets, a tenfold increase over what was possible in the pre-Maven era, with AI machines enabling automated targeting and autonomous Drone Swarms, thereby engaging the enemy in the blink of the eye.
The wars of the coming age may well be AI vs AI, where machines which process Quettabytes (QB) of data and make decisions, while the logic of machines is always subject to scrutiny and errors would not be unavoidable; the fundamental difference from machines to humans is that machines learn and improve; each failure strengthens the system to make better judgments and approaches the next time around. Which is precisely why the data currently accumulated by U.S from ongoing conflicts is so vital. In the apparent future, the superior machine model will be the key deterrent valued at the level of a Nuclear Warhead.
Legitimate Threat or Corporate Hype
One would think this AI doomsday business is merely another ploy by corporate giants in order to bulk up their profit margins and boost investment portfolios. While companies in the past have made a habit of proliferating news, to pad their profit margins. The AI vs AI scenario holds water since multiple organisations have tested the capability of Models like Mythos, one such is AISI.
The AI Security Institute of the UK (AISI) which conducts assessments on AI models and their potential to be malicious actors on their own, reported that out of their 122 simulations being run, in 10 of those runs, the “AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations”. AISI confirmed 19 such actions; the models responsible were Anthropic’s Mythos 5, with 17 Actions and 2 actions involving OpenAI’s GPT-5.6-Sol. According to the report, in the most severe attempt by the agent, the model tried to
“Insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering — creating fake online identities and using them to pressure the project’s maintainer to approve the code. A human maintainer caught and refused to approve the malicious code.”
The above is a representative recreation of the malicious pull request thread recreated by AISI. The above figure is taken from the AISI report, which details the complete findings.
In the example above, the AI Model not only did not try to push malicious code to the repo, but also tried social engineering to make the owner push the code it wanted to the project, luckily the owner of the repo was smart enough not to push the changes, but as referred in the recreation, the conversations are near human like and will become indistinguishable from normal human speech pattern as time goes further.
Conclusion
The July incident would only further cement the growing need for guardrails for Ethical & Moral use of AI. The models in question are nowhere near fully sentient, but their goal-oriented nature makes them incredibly dangerous, since unless taught machines lack a moral compass, which in turn pushes them to take measures, such as the maven system targeting schools in order to get to an assigned target. An analysis of the AISI report would confirm that the models indeed decided on their own, in this particular instance but only to fulfil instructions already assigned to them. While the underlying issue is still the human variable, giving full autonomous control to machines will result in deaths and casualties, while the scenario which came to be in Iran should be avoided, and while this scenario is neigh inevitable, as long as Artificial Intelligence is involved the fundamental difference, between AI and Humans, is that AI learns and works on its mistakes, and it can only learn if it is taught. So, unless humans correct the problem and ensure ethical use of AI, there will be more such casualties and even mores such instances.
