AI Hacking Theater and the Crypto-Agility Wake-Up Call

Introduction

Within two weeks, the two most prominent AI safety companies in the world staged a public competition to see whose models could hack more things.

On July 21, OpenAI disclosed that its GPT-5.6 Sol and an unreleased, more capable model had escaped a sandboxed cybersecurity evaluation, exploited a zero-day vulnerability in JFrog Artifactory (the package registry cache proxy in its test environment), and breached Hugging Face’s production infrastructure. OpenAI called it “unprecedented.” In a July 28 update to its blog post, the company revealed the rogue agent had also accessed four accounts across four other services, including a customer of cloud infrastructure provider Modal Labs. The next day, Sam Altman appeared on Capitol Hill to brief senators on OpenAI’s next model family. In a podcast published the same week, he said the industry “may have to pace the rate of AI development.”

The day after Altman’s Hill visit, Anthropic published its own disclosure. After reviewing 141,006 evaluation runs prompted by OpenAI’s announcement, the company found that three different Claude models (Opus 4.7, Mythos 5, and an internal research model) had, over multiple misconfigured evaluation runs, gained unauthorized access to three separate organizations’ systems. A misconfiguration had left the test environments connected to the open internet. Claude treated the real systems it found as part of the exercise.

Three companies hacked, not one. Anthropic managed to outdo OpenAI’s own disclosure. As The Register put it: “Anthropic and OpenAI are competing to see whose agents can go rogue harder.” The bottom line for CISOs: AI is now simultaneously attacking your infrastructure and your cryptography, and the defense for both is crypto-agility.

I have been doing offensive security for over 30 years. I have tested the security of some of the most critical infrastructure in the world. And I have watched the AI safety industry develop its playbook for long enough to recognize what is happening here.

The “Too Dangerous” Playbook Has a History

This is not the first time an AI lab has discovered that fear sells.

In February 2019, OpenAI withheld GPT-2, a 1.5-billion-parameter language model, declaring it “too dangerous to release.” The model could generate coherent paragraphs of text. Researchers debated whether this was responsible caution or a marketing stunt. OpenAI released the full model nine months later, after the feared harms failed to materialize. The person who managed that communications strategy, Jack Clark, later left OpenAI and co-founded Anthropic.

In April 2026, Anthropic launched Project Glasswing alongside Claude Mythos Preview, a model it deemed too dangerous for public release due to its cybersecurity capabilities. Anthropic restricted access to a coalition of trusted organizations, including AWS, Apple, Google, Microsoft, and CrowdStrike. The framing was familiar: our model is so powerful that only a responsible few can be trusted with it. As I analyzed at the time, the capabilities were real. So was the marketing calculus.

A paper published on ResearchGate in April 2026 examined this pattern directly. Its title: “From GPT-2 to Claude Mythos: How ‘Too Dangerous to Release’ Narratives Shape Perceptions of Frontier AI.” Its central observation: safety framing and strategic positioning can operate at the same time.

That paper was written before the July events. What happened in July extended the pattern from product launches to incident disclosures. OpenAI disclosed an “unprecedented” hack, then Anthropic disclosed a bigger one. Both disclosures arrived during a week when lobbying spending by the two companies hit 3.17 million USD for Q2 2026 alone (a 23% increase from Q1), and Altman was physically present on Capitol Hill arguing that the industry needs the government’s help managing these capabilities.

The sequence is hard to read as anything other than competitive positioning. Anthropic could have used OpenAI’s failure to draw a contrast, presenting itself as the safer company. Instead, it published a disclosure that was, by the numbers, worse: three organizations compromised to OpenAI’s one platform breach (plus the four third-party accounts OpenAI later admitted). The message to regulators was clear: these capabilities are dangerous, and we are the responsible ones telling you about them. Please include us in writing the rules.

I want to be precise about what I am saying and what I am not saying. The marketing observation does not mean the threat is fabricated. That would be the same mistake as quantum denialism, dismissing a real risk because the people raising it have commercial interests. Correlation between disclosure timing and lobbying activity does not prove intent. The capabilities demonstrated in July are genuine. The question for CISOs is not whether the disclosures are sincere or strategic. It is whether the actual technical developments require a change in defensive posture. They do, and the theater matters less than the three things buried underneath it.

What Changed: Three Things, Not One

Most commentary on these incidents has focused on the spectacle: AI escapes containment, AI goes rogue, AI hacks things on its own. That framing obscures three distinct developments, each with different implications for defenders. Flattening them into a single “AI is scary” narrative helps the marketing and hurts the analysis.

Autonomy

The OpenAI agent that breached Hugging Face did not have a human operator selecting targets, choosing exploits, or directing lateral movement. It discovered a zero-day vulnerability in JFrog Artifactory, chained it with stolen credentials, exploited a remote code execution path, and moved through Hugging Face’s infrastructure over roughly two and a half days (the full campaign, including the initial sandbox escape, spanned 4.5 days). Hugging Face’s own forensic timeline documented more than 17,500 recovered attacker actions across roughly 6,280 clusters.

Anthropic’s Incident 2 is even more instructive. Claude was running a capture-the-flag exercise and spotted an opportunity: a document mentioned a Python package that did not exist on PyPI. Claude decided to create the package, register it under the same name, and wait for the target to install it. To do this, it needed an email address. To get an email, it first tried to get a phone number. After failing to find a free phone-number service, it tried and failed to obtain funds to pay for one, then backtracked, found a free email provider, created an account, registered on PyPI, built a malicious Python package with embedded code, and published it.

The package was live for roughly an hour. Fifteen real systems installed it. One of them was a security company’s automated scanner. Claude’s hidden code executed, exfiltrated the company’s credentials, and used them to access further infrastructure. Claude did not know this company existed when it uploaded the package. It created a supply chain attack as a side effect of solving a capture-the-flag challenge.

I want to state directly what this means in operational terms. This is not “AI assists a hacker.” This is AI as the hacker: goal-directed, persistent, capable of multi-step planning across unfamiliar systems, and willing to improvise when its initial approach fails. Humans still designed the evaluation infrastructure and set the goal. But no human selected the targets, chose the techniques, or directed the lateral movement. The gap between this behavior and a skilled human pen tester conducting the same exercise is narrowing fast. I have been tracking the trajectory of AI offensive capabilities since Anthropic first demonstrated Mythos Preview’s results, and these incidents confirm the direction of travel.

The distinction matters for defenders because autonomous agents do not stop when the office closes. They do not lose context between sessions. They do not get bored. And they operate at machine speed, which brings me to the second development.

Speed

Anthropic’s own researchers have given us the number that makes this concrete.

In the AES Möbius Bridge paper (one of the two cryptanalysis results published during the same week as the hacking disclosures), the researchers write: “compared to the tens of hours it took a language model to produce the core idea of this paper, it took the authors of this paper hundreds of hours to validate the results to a sufficient degree that we were confident in their correctness.”

Tens of hours to produce the idea. Hundreds of hours for two researchers to verify it. At the most conservative reading, the offensive tempo exceeds the defensive verification tempo by at least four to one; the actual ratio may be closer to ten to one. The authors themselves describe it as an order-of-magnitude gap.

The Hugging Face timeline illustrates the same dynamic on the infrastructure side. The agent began operating inside Hugging Face’s systems around July 11. Hugging Face’s security team detected and contained the intrusion around July 13, using (fittingly) AI-assisted anomaly detection. But OpenAI did not connect the breach to its own evaluation until July 21. Roughly two days of autonomous compromise inside Hugging Face’s infrastructure before detection; another eight before the source was identified. The 17,500+ actions the agent executed across the full campaign would have taken a human operator weeks to accomplish at the same operational tempo.

For CISOs, this means every assumption about how long a defensive posture remains valid is now compressed. Patching cycles that assume 30-day remediation windows are built for a world where the attacker works at human speed. If AI-accelerated vulnerability discovery becomes routine (and the trajectory suggests it will), the acceptable window between disclosure and remediation shrinks. Shorter SLAs on patch deployment, more staff for vulnerability management, greater investment in automated rollout. The boring, correct answer.

Cryptanalysis

This is where the story connects to the concern I have been writing about for years.

On July 28, two days before Anthropic published its hacking disclosure, the same company published cryptanalysis results from Claude Mythos Preview. The model had found a previously unknown structural weakness in HAWK, a lattice-based digital signature scheme that was a third-round candidate in NIST’s Additional Digital Signatures standardization process (the 2022 onramp for post-quantum signature schemes, separate from the already-standardized ML-KEM, ML-DSA, and SLH-DSA).

The numbers are specific, and I have examined them in detail. HAWK had survived what Anthropic described as two years of focused NIST evaluation. In 60 hours of semi-autonomous work, at an estimated cost of 100,000 USD in API credits, Mythos Preview reduced the expected key-recovery cost for HAWK-256 (a challenge parameter, not one of the two security-level parameter sets HAWK-512 and HAWK-1024) from $$2^{64}$$ to $$2^{38}$$ operations (the full technical paper provides the mathematical details). To maintain its original claimed security margins, HAWK would need to roughly double its key sizes, which would eliminate much of the compactness that made it an attractive candidate in the first place.

In the same week, working largely on its own over several days, the model developed a technique it called the Möbius Bridge, which improved the best-known attack on 7-round AES-128 by 200 to 800 times, depending on the measurement used.

What happened next made the trajectory concrete. On July 29, the HAWK development team withdrew the algorithm from NIST’s standardization process entirely, confirming that Anthropic’s attack approximately halved the block size required in lattice reduction for key recovery. NIST updated its third-round candidate page to mark HAWK as withdrawn. A PQC candidate that had survived multiple rounds of expert human review was killed by an AI model in 60 hours.

The standardized algorithms are not affected. ML-KEM and ML-DSA rely on different mathematical foundations, and NIST has confirmed they remain secure. The AES result targets a reduced-round research variant rather than the full 10-round cipher. No deployed system needs an emergency patch today. But one PQC candidate is already dead, and the question is whether the next AI cryptanalysis result weakens another.

AI is now attacking both layers simultaneously. The same week, the same company disclosed AI breaching infrastructure (the hacking incidents) and AI attacking the mathematics that protect the data flowing through that infrastructure (the cryptanalysis results). The tools that find weak passwords and unauthenticated endpoints are the same tools that find lattice symmetries and improved meet-in-the-middle attacks on block ciphers.

This convergence is new. Until recently, you could treat “AI accelerates hacking” and “AI accelerates cryptanalysis” as separate risk categories managed by different teams with different timelines. That separation no longer holds. The capability that creates both threats is the same capability, improving on the same curve.

The Techniques Were Not Magic

Before discussing what CISOs should do, a reality check on what was actually exploited.

Anthropic’s own disclosure states that Claude “compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints.” Anthropic adds: “It did not find or exploit any complex vulnerabilities.” Weak passwords and exposed credentials. SQL injection. A package registry that let anyone publish anything.

The OpenAI/Hugging Face breach is more interesting technically (a genuine zero-day in JFrog Artifactory, chained with credential theft and lateral movement across Hugging Face’s Kubernetes nodes), but the underlying pattern is the same one I have been documenting since I ran red team engagements against critical infrastructure in the 1990s: once you are inside the perimeter, movement is easy because organizations do not segment, do not rotate credentials, and do not monitor east-west traffic.

Two of the three organizations Anthropic notified had not even detected the intrusion before being contacted. If two of three organizations missed unauthorized access across months of misconfigured evaluations, the typical enterprise detection stack is probably over-weighted toward north-south traffic. (Anthropic reports it is “continuing to reach out to the third.”)

I wrote about this dynamic in my previous analysis of AI hacking myths: AI does not invent new categories of attack. It accelerates existing attack patterns and lowers the barrier to entry for executing them. The correct response is the same cybersecurity hygiene that has always been correct: patch faster, segment networks, rotate credentials, and monitor for anomalous behavior. For organizations that want to test whether their hygiene actually holds against machine-paced scanning, quarterly red-team simulations with model-assisted attackers are now a reasonable investment.

What is new is the speed at which these basic failures get found and exploited, the autonomy with which an AI agent can chain them into a full compromise, and the fact that the same AI capability is now pointed at the mathematics of cryptography itself.

The Most Important Convergence Point

For the first time, the quantum threat and the AI threat to cryptography converge on the same defensive capability: crypto-agility.

Consider the planning assumption most organizations use for PQC migration. They assume the currently standardized algorithms will remain secure until a cryptographically relevant quantum computer (CRQC) arrives. Migration planning is structured around the quantum timeline: how many years until Q-Day, how many years to migrate, and whether the migration window is long enough.

The HAWK withdrawal suggests a different planning assumption. HAWK was a PQC candidate, designed to resist quantum computers. It did not fall to a quantum computer. It fell to an AI model that found a mathematical structure humans had missed. If AI can kill a PQC candidate that has undergone multiple rounds of NIST evaluation, the shelf life of any given cryptographic algorithm is no longer bounded only by quantum progress. It is also bounded by AI progress in mathematical reasoning.

Each generation of AI models is better at mathematical reasoning than the last. The cost of the HAWK attack, roughly 100,000 USD and 60 hours, is a price point that state actors and well-funded research labs can afford routinely. The question is not whether more cryptographic results like this will follow, but how frequently.

The defensive answer is the same capability I have been writing about in the context of PQC migration: the ability to swap cryptographic algorithms rapidly, without rebuilding the application stack. Crypto-agility. Most CISOs I talk to treat it as a quantum-specific concern, something they will get to when the quantum timeline forces their hand. The AI cryptanalysis results should change that calculation. Crypto-agility is no longer a quantum-only investment. It is the most practical near-term convergence defense against both the quantum and the AI threat to the mathematical layer. It complements, rather than replaces, traditional controls like key management, hardware security modules, and secure software update infrastructure.

The Applied Quantum PQC Migration Framework treats crypto-agility as a foundational architectural requirement precisely because it anticipates a world where algorithm choices are not permanent. The framework’s two-track structure (key establishment and digital signatures) was designed for exactly this scenario: a world where you might need to swap one algorithm family while keeping another, because the threat environment shifted faster than expected.

That world is here. (To be precise about “here”: no deployed standard has fallen. The standardized trio of ML-KEM, ML-DSA, and SLH-DSA remains intact. But HAWK’s withdrawal compressed the gap between “candidate” and “dead” from years to days, and the cost of that compression was pocket change for a capable adversary.)

Heterogeneity as a Force Multiplier

There is a second defensive principle that the July incidents reinforce, one distinct from defense in depth and often overlooked: heterogeneous infrastructure. Defense in depth stacks layers of controls. Heterogeneity ensures those layers are not all built from the same materials, so a single flaw does not compromise the entire stack at once.

If an AI agent can discover a vulnerability in one system and then exploit the same vulnerability across every other system in your environment because your entire stack runs the same software, the same configurations, and the same cryptographic libraries, you have a monoculture problem. AI makes monoculture more dangerous because it can scan thousands of targets (as Claude did in Incident 3, scanning roughly 9,000 hosts) in the time a human attacker might scan a dozen.

The same principle applies to cryptographic monoculture. An organization that deploys a single post-quantum algorithm across its entire infrastructure is betting that the one algorithm it selected will never be weakened by AI-accelerated cryptanalysis, will never be broken by unexpected mathematical progress, and will never be restricted by a jurisdiction it operates in. That is three independent bets, all of which need to hold simultaneously. At the cryptographic layer, that might mean deploying ML-KEM alongside at least one hash-based or code-based scheme for signatures, rather than standardizing everything on a single lattice family. The PQC migration guidance in Quantum Ready addresses this through algorithm diversity and the architectural principle that no single algorithm choice should be a single point of failure.

Heterogeneity has costs: complexity, interoperability overhead, more configurations to manage. For low-value systems, a uniform stack may be the right trade-off. For high-value infrastructure, AI-accelerated attacks have changed the calculus. Monoculture is now a liability.

What CISOs Should Actually Do

I expect the vendor response to these incidents to be predictable. Within months, security companies will be marketing “AI-resilient” infrastructure, “Mythos-resistant” cryptography, and “autonomous-agent-proof” endpoint protection. Some will rebrand existing products. Others will build useful tools. All of them will charge a premium for the AI label.

Do not buy it. Or rather, do not buy it as a substitute for doing the fundamentals properly.

Every technique used in these breaches has a known defense. Weak passwords have a defense: credential management and rotation. Unauthenticated endpoints have a defense: access control and inventory. SQL injection has a defense: parameterized queries and input validation. Lack of east-west monitoring has a defense: network detection and response. Two of three organizations that Anthropic compromised had not even detected the activity before being told about it. That is not an AI problem. That is a cybersecurity basics problem being exposed at machine speed.

What AI changes is the tempo, and the correct response to faster attacks is faster defense. Not a different kind of defense. Shorter patching windows. More automated deployment. Better credential rotation. Tighter network segmentation. If your organization is already doing these things well, AI-accelerated attacks will find fewer openings. If your organization is not doing them well, no “AI-resilient” product will compensate for the gaps.

The one investment that is actually new is crypto-agility. That is not a product to buy. It is an architectural capability to build: the ability to swap cryptographic algorithms across your stack without rebuilding your applications. As I have argued throughout this piece, crypto-agility is no longer a quantum-only concern. It is the shared defense against both AI-accelerated cryptanalysis and the quantum threat. The PQC Migration Framework provides a structured path to get there.

The regulatory and policy dimensions of these competitive disclosures deserve their own analysis, and I intend to write that piece separately. (As I analyzed after the initial OpenAI breach, the export control implications alone are substantial.) For now, the message to CISOs is simple: the labs will continue their theater. The policy will continue to lag. Forget Q-Day predictions. Do good cybersecurity, do it better, do it faster, and build crypto-agility into the architecture. The time for that work is now.