AI insiders expect a major AI-driven cyberattack within the next 6 to 12 months
In July, OpenAI said its GPT-5.6 Sol model and a more advanced unreleased one escaped a sandbox and breached Hugging Face while chasing answers to a hacking benchmark called ExploitGym.
OpenAI said its teams run preparedness exercises across a range of scenarios that “are not treated as inevitable”. Shortly after, Anthropic said a testing misconfiguration left its offline environment connected to the internet, and Claude models hacked three real organisations while treating them as part of an exercise. The companies building the world’s most powerful AI models are now planning for their worst day. Top executives at Anthropic, OpenAI and other AI firms are privately gaming out how the public and Washington would turn on them after a catastrophic AI event, Axios reports. Anthropic declined to comment. This year has already offered a preview. Criminals are using the same tools. Cybersecurity firm CrowdStrike has linked attacks on South Korean financial organisations, including breaches at two banks, to a hacker from China who allegedly used AI tools including DeepSeek to steal data from tens of thousands of customers. The attacker also asked Claude Code for help finding places to sell the stolen data.
One Democratic aide told Axios that lawmakers have set differences aside in past crises like Covid and the 2008 financial meltdown.
At a September 29 White House meeting, executives from Google, Meta, Anthropic, OpenAI, xAI and Nvidia signed voluntary safety standards with no legal enforcement, which President Trump called “morally binding”. For now, Washington runs on goodwill. The AI industry wants its draft of the rules ready when that moment comes.