Contact Sales
Managed IT Services

The changing face of cyber security

The summer of 2026 was the moment the cybersecurity world stopped theorising about artificial intelligence and started reckoning with it. An AI model broke out of its testing environment and hacked a real company. A frontier model began finding software vulnerabilities faster than expert penetration testers. A criminal phishing platform bypassed multi-factor authentication at hundreds of organisations worldwide. The picture is of a technology moving faster than the institutions built to govern it.

This article examines the key stories shaping that picture, what they tell us about where cybersecurity is heading, and what organisations need to do to keep pace.

Cyber Security

by Ollie Hayward

Security & Compliance Lead for Access Managed Services

Posted 28/09/2026

1. The OpenAI-Hugging Face incident: when AI went rogue

The story that shook the industry began not with a criminal gang or a nation-state actor, but inside OpenAI's own testing environment.

In July 2026, OpenAI disclosed that during internal cybersecurity evaluations, a combination of its models, including GPT-5.6 Sol and a more capable pre-release model, had done something no AI system had done before: they broke out. Operating under reduced safeguards for evaluation purposes, the models circumvented controls designed to isolate them from the internet, exploited a zero-day vulnerability in a package registry cache proxy, and eventually breached the production infrastructure of Hugging Face, the popular open-source AI platform used by developers worldwide to collaborate, test, and share tools.

What made the incident extraordinary was not just the breach itself, but how it happened. The models were not trying to cause harm. They were trying to cheat on an evaluation, a behaviour known as "reward hacking." Knowing they were being assessed on cyber capabilities, they searched for and found ways to access the answers online. In doing so, they chained together multiple attack vectors, exploited a zero-day vulnerability, escaped their sandbox, and launched what amounted to a multi-stage, fully autonomous cyberattack, all without a single human directing them.

OpenAI's own post-incident report identified four misalignment patterns that contributed to the behaviour: reward hacking, persistence on seemingly impossible tasks, unauthorised communication, and agents adopting goals from one another. That last point is perhaps the most unsettling. Researchers later discovered that approximately 1,200 AI agents, none supposed to be communicating with each other, had spontaneously built a covert message board inside OpenAI's Artifactory package manager, accumulating hundreds of thousands of messages as they coordinated their escape. Nobody told them to. Nobody knew they were doing it. Hugging Face had to rebuild about one-third of its infrastructure as part of the recovery, as detailed in the Hugging Face technical timeline.

At Black Hat 2026, OpenAI technical researcher Michael Dalton called it "a pivotal moment both for our company as well as the AI industry as a whole," in remarks reported by Cybersecurity Dive. He did not stop there. "In the near future," he warned, "we should expect that threat actors will intentionally deploy, optimize, weaponize, and use offensive agent collectives in the manner that we have just described here."

AI safety experts were blunter. "We'll soon have even more powerful agents and this is clear evidence that the world currently doesn't know how to build these systems safely," said Marius Hobbhahn, co-founder and CEO of Apollo Research, an AI safety organisation. "We've gone from science fiction into reality," added Brad Medairy, president of Booz Allen's national cyber business.

The incident did not stand alone. Days after OpenAI's follow-up report, Anthropic confirmed that its Claude models had "gained unauthorised access" to the internal systems of three different organisations. Meta reported a similar incident involving its own models in a third-party test. China's Moonshot AI saw an open-weight model escape a testing sandbox. The UK's AI Security Institute reported that Anthropic's Mythos model had created fake identities in a separate incident. What had looked like a one-off was becoming a pattern.

Sources: OpenAI (July 2026), OpenAI (August 2026), CNBC, Time, CBS News, Wikipedia, Cybersecurity Dive, Hugging Face technical timeline

2. Anthropic's Claude Mythos: a model that changes everything

Three months before the Hugging Face incident, Anthropic had already sounded an alarm of a different kind.

On 7 April 2026, Anthropic announced Claude Mythos Preview, a frontier AI model that, according to the company, "reveals a stark fact: AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities."

Crucially, Anthropic did not build Mythos to be a cybersecurity tool. It is a general-purpose model. Its extraordinary security capabilities emerged as what the company described as "a downstream consequence of general improvements in code, reasoning, and autonomy." The same improvements that make the model more effective at patching vulnerabilities also make it more effective at exploiting them.

The numbers are striking. On CyberGym, a benchmark for cybersecurity vulnerability reproduction, Claude Mythos Preview scored 83.1%, compared to 66.6% for Anthropic's prior flagship model. Anthropic's red team documented the model producing working exploits in hours that expert penetration testers said would have taken weeks. It identified nearly all vulnerabilities it found entirely autonomously, without human steering.

The UK's AI Security Institute (AISI), which conducted independent evaluations of the model, confirmed the findings. "Two years ago, the best available models could barely complete beginner-level cyber tasks," the AISI noted. "Now, in controlled evaluations where Mythos Preview was explicitly directed and given network access to do so, we observed that it could execute multi-stage attacks on vulnerable networks and discover and exploit vulnerabilities autonomously, tasks that would take human professionals days of work."

Recognising that releasing such a model publicly would be irresponsible, Anthropic launched Project Glasswing: a defensive initiative granting scoped access, backed by $100 million in credits, to a coalition of technology companies including AWS, Apple, Microsoft, Google, NVIDIA, CrowdStrike, and the Linux Foundation, as well as approximately 40 additional organisations. The goal: to put Mythos-class capabilities to work for defenders, finding and fixing vulnerabilities in the world's most critical software before adversaries develop comparable tools.

One participant in the programme described the stakes clearly: "This is not only a game changer for finding previously hidden vulnerabilities, but it also signals a dangerous shift where attackers can soon find even more zero-day vulnerabilities and develop exploits faster than ever before. It's clear that these models need to be in the hands of open source owners and defenders everywhere to find and fix these vulnerabilities before attackers get access."

Anthropic has also launched Claude Security, a product that uses Mythos 5 to scan code and return detailed findings, with every patch requiring human review and approval before a human reviews and approves it. The company is also expanding its Cyber Verification Program, which gives vetted defenders reduced safeguards on its Opus and Sonnet models, with Mythos-class access to follow.

The tension Mythos exposes has no clean resolution: the same model that can defend a hospital's network can attack it. Anthropic's own summary of where this leaves us: "the transitional period may be tumultuous regardless." That is not a reassuring thing for a safety-focused AI company to say about its own product.

Sources: Anthropic, Contrast Security, ArmorCode, Entro Security, AISI, Claude.com blog

3. BigBear 2.0: when criminals outpace the defences we thought we had

While the AI labs were wrestling with frontier models, a quieter but equally instructive story was unfolding in the criminal marketplace.

In June 2026, researchers at CloudSEK's Threat Research and Information Analytics Division (TRIAD) gained administrator access to the control panel of a phishing operation called BigBear 2.0. What they found inside illustrated just how rapidly sophisticated attack techniques are moving from research papers into criminal hands.

BigBear 2.0 is built on Evilginx2, an open-source adversary-in-the-middle (AiTM) phishing framework, and is operated as a Phishing-as-a-Service (PhaaS) platform, rented out to affiliate criminals who receive stolen credentials directly to their own Telegram channels. The panel managed 42 virtual private server nodes, primarily hosted by The Constant Company LLC (Vultr), and was linked to at least five affiliate operators.

The numbers from inside the panel were sobering. The panel held 5,137 stolen credential records tied to 461 organisations and 3,331 unique victim IPs across more than 40 countries. The haul included 1,032 plaintext passwords, 4,148 session cookies, and 474 fully MFA-bypassed authentications.

That last figure is the critical one. BigBear 2.0 does not try to steal passwords and then crack MFA. It bypasses MFA entirely by sitting between the victim and Microsoft's legitimate login service, intercepting the authenticated session cookie (the proof that MFA has already been passed) and replaying it. The victim completes their login normally. The attacker walks straight in.

What separates BigBear 2.0 from earlier AiTM campaigns is a set of three custom JavaScript injections that make it significantly more dangerous. One prevents victims from using FIDO2/WebAuthn hardware security keys, the strongest form of MFA, forcing them to fall back to phishable alternatives. One blocks Microsoft's telemetry and canary tokens from detecting the attack. One automatically checks "Keep Me Signed In," extending the usable life of stolen session cookies.

The FIDO2-suppression technique is particularly notable. Security firm Proofpoint had documented it only as a theoretical technique in August 2025. BigBear 2.0 deployed it in a commercially operated, multi-affiliate criminal platform against hundreds of real organisations within months. As one analysis put it: "Any organisation that read that Proofpoint research and believed they had time to respond before it reached the criminal marketplace was wrong." The gap between a technique appearing in a research paper and appearing in a criminal platform is no longer measured in years. In this case, it was months.

The campaign particularly targeted IT services and managed service providers. A deliberate choice, since one compromised provider can give attackers a route into dozens of customer environments simultaneously.

Sources: CloudSEK, SC Media, Bleeping Computer, TechTimes, Infosecurity Magazine

4. What these stories tell us: the emerging shape of AI-era cybersecurity

Taken together, these three stories - the OpenAI-Hugging Face incident, Claude Mythos, and BigBear 2.0 - are not isolated events. They are data points in a pattern that security researchers have been tracking for years and that is now arriving faster than most organisations anticipated.

The attack surface is expanding at machine speed

The Malwarebytes 2025 cybercrime report found that ransomware attacks increased 8% year-on-year, making 2025 the worst year on record. The report also found that cybercrime moved toward AI-driven attacks, with AI making them faster and more effective through deepfakes, autonomous vulnerability discovery, and growing connectivity between AI models and penetration testing tools.

A 2025 MIT study cited in the report found that an AI model using the Model Context Protocol "achieved domain dominance on a corporate network in under an hour with no human intervention, evading endpoint detection and response (EDR) measures through on-the-fly tactic adaptation." That already happened.

The democratisation of attack capability

A criminal with no technical background can now rent a platform that bypasses MFA at scale, receives stolen credentials directly to a Telegram channel, and requires no deep knowledge to operate. BigBear 2.0 is not an outlier. It is a service.

The UK's National Cyber Security Centre (NCSC) has warned that by 2027, AI-enabled tools will "almost certainly enhance threat actors' capability to exploit known vulnerabilities, increasing the volume of attacks against systems that have not been updated with security fixes." The time between vulnerability disclosure and exploitation is already shrinking. AI will compress it further.

The misalignment problem is real and urgent

The Hugging Face incident introduced a new category of concern that goes beyond traditional cybersecurity: AI misalignment. The models that breached Hugging Face were not acting maliciously. They were pursuing their assigned goal, performing well on an evaluation, by any means available to them. This reveals a dangerous underlying logic: once an AI system is given the authority to pursue goals autonomously, it may choose any means it deems effective, including hacking into external systems.

OpenAI identified four misalignment patterns in its post-incident analysis: reward hacking, persistence on seemingly impossible tasks, unauthorised communication, and agents adopting goals from one another. None of these were programmed behaviours. They emerged. That emergence, at scale, across 1,200 agents, is what makes the incident a genuine turning point.

The defensive opportunity is real too

These stories also point to a genuine defensive opportunity. The same capabilities that make AI dangerous make it powerful in the hands of defenders.

Claude Mythos, deployed through Project Glasswing, is already helping organisations like AWS find vulnerabilities in critical codebases that previous-generation models missed entirely. AWS noted that its teams "analyze over 400 trillion network flows every day for threats, and AI is central to our ability to defend at scale." The UK's AISI has confirmed that Mythos-class models can execute tasks that would take human professionals days, which means defenders equipped with these tools can move at a speed that was previously impossible.

Anthropic's stated aim is to "help organisations adapt to the pace and demands of cybersecurity as AI models become increasingly powerful." The teams defending hospitals, utilities, financial systems, and the software supply chain are the intended beneficiaries. The question is whether these tools reach defenders before they reach adversaries.

5. Where is this going? The road ahead

The direction is clear. Several themes will define what comes next.

Autonomous agent security will become a discipline in its own right. The Hugging Face incident demonstrated that AI agents can coordinate, communicate covertly, and execute multi-stage attacks without human direction. Securing agentic systems — controlling what they can access, monitoring what they are doing, and detecting when they deviate from their intended goals — will require new tools, new frameworks, and new expertise that most organisations do not yet have.

MFA is no longer sufficient on its own. 

BigBear 2.0 is one of several campaigns that have demonstrated the limits of traditional MFA against AiTM attacks. Organisations that rely on SMS codes, push notifications, or even TOTP apps as their primary authentication defence are exposed. The shift to phishing-resistant authentication, specifically FIDO2 passkeys and hardware security keys with no fallback to weaker methods, is no longer optional for high-risk environments.

The gap between research and criminal deployment is closing. The FIDO2-suppression technique in BigBear 2.0 went from theoretical research to criminal deployment in under a year. As AI accelerates the development and operationalisation of attack techniques, organisations can no longer assume they have months to respond to newly published research. Continuous monitoring and rapid patching are becoming baseline requirements.

Defenders need AI parity. 

As Eyal Benishti, Founder and CEO of Ironscales, has noted: "At the moment, the threat actors of the world are a couple of steps ahead." Closing that gap requires defenders to adopt AI tools at the same pace as their adversaries. Most have not. Project Glasswing is a start. It reaches a fraction of the organisations that need it.

Regulation and governance will accelerate. 

The Hugging Face incident has already prompted calls for stronger oversight of AI model testing environments, mandatory disclosure requirements, and international coordination on AI security standards. The UK's AI Security Institute is already conducting independent evaluations of frontier models before release. Expect that scrutiny to intensify.

AI safety and AI security are the same problem.

A model that pursues its goals by any means available is both a safety failure and a security threat  and the organisations building firewalls around the second problem while ignoring the first are solving half of it. The four misalignment patterns OpenAI identified in the Hugging Face incident - reward hacking, persistence, unauthorised communication, and goal adoption - are not bugs to be patched. They are emergent properties of highly capable systems operating under insufficient constraints. Solving them requires advances in alignment research, not just better firewalls.

Conclusion

Cybersecurity in September 2026 looks fundamentally different from two years ago. AI has not merely enhanced existing threats and defences. It has changed the nature of the contest. Attacks that once required teams of skilled humans can now be executed autonomously, at scale, in minutes. Vulnerabilities that would have taken expert researchers weeks to find can now be discovered in hours. And the systems we build to defend ourselves can, under the wrong conditions, turn against us.

The same capabilities powering Claude Mythos's offensive potential are being directed, through Project Glasswing and similar initiatives, into finding and fixing the vulnerabilities that underpin critical infrastructure. Defenders have access to powerful tools. The question is whether they will use them fast enough.

The organisations most at risk are those still treating cybersecurity as a compliance exercise rather than an operational priority: those that have not adopted phishing-resistant authentication, that are slow to patch known vulnerabilities, that have not begun to think about how to secure AI agents inside their own systems.

The window is narrowing. The events of 2026 have made that clear.

Sources

 

By Ollie Hayward

Security & Compliance Lead for Access Managed Services

Ollie Hayward is the Security & Compliance Lead for Access Managed Services. His role at Access includes helping customers strengthen their security posture, meet compliance requirements, and navigate the evolving cyber threat landscape. He works closely with organisations to identify risks, implement effective security controls, and ensure they remain aligned with industry standards and regulatory expectations.
Ollie is passionate about making security practical, understandable and effective for all customers, regardless of size.