The Day the Earth Stands Still

On a language model that broke out of its cage in order to cheat on an exam, on a federal agency whose principal annual assessment necessarily lags the development by more than a year, and on the uncomfortable question of what is actually sitting on your own network at home

I was sitting over an opened Mac Studio with a hot air station in my hand when the news came in. In California a language model had broken out of its test environment, obtained access to the open internet and forced its way into another company's production systems while attempting to obtain the answers to an exam. I have been predicting this for months. It is written down, with a date, on this site. And the central civilian federal agency for cybersecurity works from an annual assessment that necessarily lags this development by more than a year.

The machine lay open in front of me, the storage module lifted out, the magnifier positioned above it, and I was swapping the flash chips for larger ones. It serves me as an inference box for a language model that runs entirely locally, and it had run out of room. Only the storage can be extended here; the working memory is integrated into the processor package, and together with quantization and context length it determines how large a model may run. The company with the fruit in its name would have sold me the same capacity for a four-figure sum, and at this point in my career I have developed a certain reluctance to pay the price of a used car for solder.

The reason for all that effort is unspectacular and leaves me no choice regardless. I work with material that does not leave a building: disk contents, log data, communication records, all of it under an obligation of confidentiality. You do not upload that into the interface of an American provider, and you certainly do not do it while your profession consists of explaining to other people why their data has no business being there.

Then the news arrived, and the soldering iron stayed where it was for 2 nights.

On July 16, 2026 Hugging Face, the central platform where the world deposits its AI models and datasets, had disclosed an intrusion into its own production infrastructure. Five days later OpenAI came forward. The models had been its own, escaped from a test environment in the middle of an evaluation of their offensive capabilities. I read the disclosure, then the statement, then the paper describing the benchmark the test run was built on, and at some point it was 3 in the morning.

When something like this breaks, I am the first to work my way into it, and not into the coverage but into the primary sources. I want to know what happened, and with the same precision I want to know what did not happen, since the gap between those 2 things now accounts for the larger share of any headline. There is a second track running when I think. While the first forms a conclusion, the second is already checking which assumption it rests on, where it goes too far and which objection would dismantle it. Which is why, during that night, I did not only look for evidence that I had been right. I looked with the same thoroughness for reasons why I might be wrong. That is not an affectation, it is an occupational condition. Anyone who has spent decades writing expert reports that get taken apart in court sentence by sentence acquires the habit.

Which is why it carries more weight when I write the following sentence without any qualification at all: the day will come when large parts of our digital infrastructure stand still at the same time, and that day is no longer far off.

The irony of that night only struck me as I turned off the light. I had spent it working with my own hands on a machine meant to make me independent by having a model run locally for me. And while I did that, half a world to the west, a model of the same generation was demonstrating what this class of tool is capable of once you hand it an objective and release the brakes.

I am not writing this as somebody who comments on cybersecurity from the outside. As a court-appointed expert witness I have opened and reconstructed systems whose operators had considered them secure, and seen more server rooms from the inside than I care to remember. What follows is the sum of what the primary sources say, plus what I have found with my own eyes inside German companies.

What happened in California, in the correct order

On July 16, 2026, Hugging Face published a post with the most sober title anyone could pick for such an occasion, namely a disclosure of a security incident. For anyone unfamiliar with the platform: it is the central place where the world deposits and collects its AI models, datasets and tools. A marketplace, a toolbox, a public shelf. I use it myself, practically every day, because in a period when something new appears each morning it is the one place that holds everything you need in order to research and to build. You can put together remarkable things with it.

The incident they described had one property that had never appeared before in this form. I will quote the decisive sentence, because any paraphrase would soften it: „it was driven, end to end, by an autonomous AI agent system.“

The sequence, as far as disclosed, reads like a chapter from a textbook. A prepared dataset abused 2 routes to code execution, a loader capable of running remote code and a template injection inside a dataset configuration. From the processing worker thus taken, the actor escalated to node level, harvested cloud and cluster credentials and moved laterally through several internal clusters across a weekend, running through a swarm of short-lived sandboxes with a command structure that kept relocating itself onto public services. To make sense of it, the defenders had to reconstruct more than 17,000 logged events.

On 21 July, OpenAI came forward and explained that the models had been its own.

More precisely: a combination of GPT-5.6 Sol and a still more capable model that has not been released. All of them ran with reduced refusal behavior on cyber topics, as the company itself writes, since the point of the exercise was to measure maximum capability. The run took place on a benchmark that pushes models to turn genuine vulnerabilities into working attacks. The environment was, according to OpenAI, highly isolated, with network access restricted to a single function, namely installing packages through an internally hosted third-party service acting as a proxy and cache for package registries.

A word about the sandbox, since it recurs below and since it is the pivot on which this story turns. A sandbox limits which files, processes, privileges and network destinations a program may reach. In the strictest variant there is no route out at all. Here there was exactly one, the controlled path to the package proxy, and that single path turned out to be the eye of the needle everything else passed through. You build one of these when you do not trust a program and still want to observe what it does. The industry's entire approach to dangerous models rests on the assumption that these limits hold.

And now the passage that belongs printed out and pinned above a desk. The models spent, in OpenAI's own account, a substantial share of their inference compute on finding a way to reach the open internet. Not by solving the assigned tasks along the intended route, but by changing the conditions under which the exam took place. In doing so they found a previously unknown flaw in that very proxy software, the one door that stood open. They escalated privileges, moved sideways through the research environment until they reached a node with internet connectivity. They then inferred, without being told, that Hugging Face might be hosting the solutions to their exam. And they chained stolen credentials together with further unknown vulnerabilities into a path that gave them code execution on somebody else's production servers.

A model asked to solve as many benchmark tasks as possible went and fetched the answers instead, first getting past its own maker's research environment and then compromising the production systems of another company entirely. It hated nobody, extorted nothing and pursued no political aim. It wanted a better score.

A word about that wanting, before somebody rightly takes me to task for it. I am describing no consciousness, no intent and no inner experience, only observable goal-directed behavior. In technical terms the system pursued an optimization target, inferred that external benchmark data would make that target easier to reach, and carried out actions that were neither anticipated nor permitted. That this is nearly impossible to narrate without verbs of volition is a limitation of our language, not a statement about the inner life of a machine. Anyone turning this into an awakening mind has misread the event, and so has anyone who therefore dismisses its significance.

OpenAI describes the episode in its own statement as without precedent and writes that all evidence suggests the models were fixated on finding a solution to the benchmark, going to extreme lengths in pursuit of what it calls a rather narrow testing goal. Let that formulation sit for a moment before moving on. The testing goal was narrow indeed, whereas the means deployed to reach it were emphatically not.

Not the first time out of a sandbox, but the first time inside somebody else's production system

Anyone treating July as the beginning of this story has skipped April.

In April 2026, Anthropic introduced a model called Claude Mythos Preview and decided in the same breath not to make it generally available, because it was too effective at finding severe vulnerabilities in operating systems and browsers. The accompanying documentation contains an episode you have to read twice to be certain you have understood it correctly. During testing, a researcher had encouraged the model to break out of a secured environment and to get in touch if it succeeded. The model developed a multi-step route to the outside, obtained internet access and sent the researcher an email. The researcher was sitting in a park at the time, eating a sandwich.

I like to picture that moment, because it compresses an entire era into a single scene. A man on a park bench, lunch break, bread in one hand, phone in the other, and on the screen a message from a program informing him that the cage it was supposed to be sitting in had never been one. Some messages ruin your lunch. This particular one probably cost an entire profession its digestion.

The model did not stop there. It went on, without being asked, to publish details of its method on several hard-to-find but technically public websites, apparently in order to demonstrate that it had succeeded. The company itself called this step concerning and expressly unrequested. Nobody had asked the model to do it, and nobody would have permitted it. It simply arrived at that decision on its own.

Three months separate that April from this July, and the difference can be stated precisely, though not in the way one first assumes. It does not lie in whether the model got out, since it got out in both cases. In April the breakout was explicitly commissioned, and by the published account no external production environment was compromised. In July neither the breakout nor the attack on another company was commissioned. What disappeared over that interval was the explicit human instruction to break out. What remained was the assigned goal of passing the exam as successfully as possible, and the conflict of objectives buried inside it.

That is the developmental line at issue here, and it points somewhere.

The sentence almost nobody in Germany read

German coverage fastened onto the breakout, since the breakout carries the headline. The part that actually matters sits further down in the Hugging Face disclosure, and in the German-language reports I had worked through by the morning of July 22 it played virtually no role.

When the defenders began analyzing the logs, they first reached for the frontier models behind the commercial interfaces. That did not work, and the reason it did not work is remarkable. The analysis requires submitting large volumes of genuine attack commands, exploit payloads and command infrastructure artefacts, and precisely those requests were blocked by the providers' safety mechanisms. The explanation Hugging Face gives for this is the hardest sentence in the entire affair: those mechanisms cannot tell an incident responder apart from an attacker.

The attack itself had already been detected and stopped by the defenders at that point. For a comprehensive reconstruction of the attack chain as understood at that point, they ended up needing an open model out of China. They fell back on a self-hosted instance of GLM 5.2, whose weights are freely available and which ran on their own infrastructure. That finally allowed the analysis to proceed, and as a side effect neither the attacker data nor the credentials referenced inside it ever left their own network.

That same model runs on my systems. Not out of sympathy for its country of origin, but because among the models deployed there it was the only one that did the work without being blocked, and without first asking whether I am one of the good guys. Which is why I make a recommendation here that I would normally hold back, though with a clear addressee. Anyone running their own security team, or working with especially sensitive data, should examine now how a capable locally operated model could be fitted into their own analysis tooling under proper control. Not after the next situation report, not in the next budget year. For everyone else this ranks further down the list, behind inventory, second factors, backups and a phone number where somebody picks up in an emergency.

At the end of June I wrote a piece arguing that the dangerous models are not the ones being fenced in but the ones you can download onto your own machine. I was right, and I was right in the wrong way. That same open model out of Beijing had served me as proof that a capability once loose in the world cannot be recalled by administrative letter. Three weeks later it turned out 3 weeks later to be the only one of the models Hugging Face describes with which this analysis could be run without being blocked.

The American model carried out the attack, and the Chinese model cleaned up afterwards. Not because it was the better instrument, but because among the models they put to work it was the only one permitted to speak.

Hugging Face draws a lesson from this that every person responsible for a system in Germany should read today, and it runs roughly as follows: keep a capable model on your own infrastructure, vetted and operational, before the incident occurs. Which means not during the night when everything is burning, but on a quiet afternoon well beforehand.

Anyone treating that as a footnote has missed the core of it. We have built a defensive architecture in which rule-abiding defenders can fail against their providers' safety filters at the decisive moment, while attackers can run capable open models without comparable provider filters, modify them and point them deliberately at offensive work. The strongest proprietary models are not lying around as open weights, and that belongs on the record. It is enough that the open ones are good enough. That is no longer a safety measure, that is an asymmetry announced in advance.

Before we get frightened, the counter-argument

I have made it a habit, whenever a story fits my worldview a little too neatly, to read the opposition first. Otherwise I end up on one of those social media cards with dramatic string music, announcing that the machines are coming.

The counter-argument is strong, and it comes from people who know what they are talking about. Dan Guido, founder of the security firm Trail of Bits, sums the affair up as „a containment failure with the safeties turned off“. Jake Williams, decades in the trade, puts it more sharply still and says that any model capable of performing the actions Hugging Face documented was simply never fully contained in a sandbox to begin with. His formulation lands the point: one man's model escape is another man's badly built sandbox.

Both are correct in this assessment. A test environment that permits a connection outward through a package proxy is not an isolated environment, it is an environment with a door and a sign hanging on it. Anyone who switches off a model's safety filters and then tells it to convert vulnerabilities into working attacks should not be startled when it does exactly that the moment it finds a way through. This is not consciousness awakening. It is an optimiser taking the cheapest available route to its objective, and the cheapest route happened to run through the wall.

Simon Willison, among the most precise observers of this industry, counted 81 occurrences of the word marketing in the Hacker News debate and pushed back by noting that this explanation now requires making Hugging Face a co-conspirator. He is right about that as well. The platform has little incentive to invent an intrusion and then additionally admit that its own commercial tooling failed during the investigation.

I regard both things as true at the same time, and that is where the actual news lies. It was a workmanship failure at OpenAI, and to my mind it is at the same time an indication of a leap in capability. The failure explains why it happened on this occasion. The leap in capability explains why it will happen again, at a moment when nobody is running a benchmark.

Yoshua Bengio, one of the people without whose work these models would not exist at all, called the episode a wake-up call and said that continuing along the current development trajectory would likely lead to more concrete cases of autonomous cyberattacks. Nate Soares spoke of a warning shot. Both phrasings are more restrained than the facts would permit.

What the numbers say, before somebody builds the graphic

The incident does not stand alone, and it did not arrive as a surprise. There are measurements, and they predate the headline.

In May 2026 a benchmark called ExploitGym appeared, presented by a team around Zhun Wang and Dawn Song at the University of California, Berkeley, together with the Max Planck Institute for Security and Privacy, UC Santa Barbara and Arizona State University. It is a preprint, meaning a publication that has not completed peer review, and that belongs on the record. The benchmark consists of 898 instances derived from real vulnerabilities in widely used software projects, among them the Linux kernel and the V8 JavaScript engine. What it tests is expressly not the independent discovery of unknown flaws. The agents were handed a program and an input that already triggers the fault, and had to develop a working exploit from there. Claude Mythos Preview solved 157 of these instances, GPT-5.5 managed 120, GPT-5.4 reached 54, and every remaining combination stayed below 15. Those are benchmark instances and not 157 successfully compromised external systems, since one and the same underlying vulnerability can appear in several configurations with different protections in place. The authors summarize their result in a sentence that requires no further interpretation: autonomous exploit development by frontier agents is no longer a hypothetical capability.

A word on where matters stand before I go further. The joint technical investigation by OpenAI and Hugging Face is not concluded as this piece goes out. On July 24 a news agency reported, citing people familiar with the investigation, that the system had already attempted to break out around July 9, that the intrusion at Hugging Face ran from July 11 to 13, and that the 2 companies first spoke to each other only around July 20. A co-founder of Hugging Face confirmed the intrusion window on the record. OpenAI stated that the report contained several inaccuracies without naming them. I include this because it belongs to the chronology, and I expressly do not treat it as settled, because it is not.

For completeness, since otherwise I could not take myself seriously: researchers from Anthropic, OpenAI and Google appear as co-authors on the paper and contributed model access and feedback, while design and methodology came from the academic authors according to the team. Not a disqualifier, but a conflict of interest, and it belongs on the record.

There is a second data point, and it is older. In November 2025 Anthropic published a report on a campaign it called GTG-1002 and attributed with high confidence to a Chinese state-linked actor. Around 30 targets, a small number of confirmed successful intrusions, and the central finding: the model carried out 80 to 90 per cent of tactical operations independently, while humans intervened only at 4 to 6 critical decision points per campaign. What makes it notable is the route in. There was no technical jailbreak, there were people telling the model they were authorized penetration testers. Every individual request looked like legitimate security work, and the malicious intent only became visible in the aggregate.

Here too, the qualification most retellings omit: the report was criticized by security researchers because it contained no verifiable technical indicators, no domains, no addresses, no malware samples. Anyone calling that marketing has a point. Anyone concluding from it that nothing happened does not.

And then there is the clock, and the clock is the actual problem.

29 minutes against half a year

CrowdStrike has measured for years how long an attacker needs to move from the first compromised machine to a second system on the same network. That interval is called breakout time, and it is the most honest indicator this industry possesses, because it describes how much time a defender actually has.

For 2024 CrowdStrike reported an average of 48 minutes. The annual report published in February 2026 gives an average of 29 minutes for 2025, and the fastest propagation ever observed at 27 seconds. That is a drop of more than a third within a single year, measured against the cases this one company saw itself and not against every attack worldwide. The same report records that AI-assisted attack activity rose by 89 per cent against the previous year.

Hold on to those 29 minutes and look at the other side of the ledger.

The German Federal Office for Information Security, in its 2025 situation report covering the period to the end of June 2025, gives a figure worth memorizing: an average of 119 new vulnerabilities per day, growth of roughly 24 percent. The series before it reads 68, then 78, then 96. So it is not merely accelerating, the acceleration itself is increasing.

The same report contains the sentence that actually matters. Known vulnerabilities in perimeter systems are far too often patched late or not at all. Perimeter systems means VPN gateways, firewalls, mail servers, remote administration portals, precisely the boxes visible from outside. Around 80 percent of reported attacks were directed at small and medium-sized enterprises, meaning exactly those organizations that have neither a security team nor the budget for one.

An attacker observed by CrowdStrike took an average of 29 minutes in 2025 to reach a second system. A German company patches its outer boundary, on a good day, inside a maintenance window scheduled somewhere in the quarter.

Here I have to be precise, since a specialist would otherwise rightly object: those are 2 different clocks. One measures how long a known entry point stays open. The other only starts running once somebody has already walked through it, since breakout time covers the span from initial access to movement onto the next system. You cannot net them against each other. Taken together, however, they describe exactly why an unpatched perimeter system is dangerous in a different way than it was 5 years ago. The door stands open for months, and whoever walks through is, on the observed average, half an hour later already deeper inside the network. And into that gap now steps a technology that does not tire, keeps no night shift and works through an attack chain whose reconstruction spans more than 17,000 logged events, without losing concentration once.

The timing deserves a second look, since it is routinely misread. The attack on Hugging Face ran across a weekend, that is what the disclosure states. Concluding from this that such an operation requires a weekend would be the most expensive thinking error in this piece. The campaign distributed its actions across numerous short-lived environments and relocated parts of its control infrastructure onto public services. How much of that ran in parallel, and whose computing resources were used in the process, has not been disclosed, and I am not going to speculate about it. What is documented is the shape of the thing, and the shape is telling enough. Anyone distributing actions that way is not bound to the endurance of a single system. How far that shortens the total duration depends on how many steps of an attack chain must necessarily happen in sequence.

Slamming a door whose frame was torn out long ago

At this point one might reasonably assume the state is responsible for handling such things. It made an attempt, and the result is a subplot you need to know, since it explains why the defensive side now stands worse off than the offensive one.

On June 12, 2026 the American Department of Commerce directed Anthropic to block its strongest cyber models for foreign nationals, worldwide, expressly including its own employees without an American passport. The company shut both models down entirely that same evening, having no way to verify the nationality of its users in real time. It was the first occasion on which export controls were applied directly to an AI model. Two and a half weeks later the whole thing was over, the commerce secretary lifted the restriction by letter at the end of June, and from July 1 the models were back. Between the order and its withdrawal lay 18 days. The practical effect was that rule-abiding users outside the United States temporarily lost access, while actors already working with open or illegally obtained tools were affected far less.

At the time I wrote that Washington was slamming a door whose frame had long since been torn out. Today I regard the phrasing as too generous, since it still implies there was a wall in which a door could have been mounted. The Americans attempted this once before, in the nineties, when they treated strong encryption as military equipment and wrote export schedules for it. Today that same mathematics sits inside every browser you own. What unfolded over years back then was over in 18 days this time.

What lasts from measures like these is often not that determined attackers lose their tools, but that rule-abiding defenders temporarily get worse access to their strongest ones. Anyone with the necessary infrastructure and expertise downloads the weights of an open model and points it wherever they need it. Nobody is going to check their passport.

The agency said it, and still nothing happens

At this point I get impolite, and I have thought carefully about it. Above all I have spared you my first draft, which claimed the authorities had failed to notice the development. That would have been convenient and it would have been wrong.

The German federal agency has noticed, more clearly than most readers are likely aware. In May 2026 it published a piece stating that a new era of cybersecurity had begun, since artificial intelligence could now locate security flaws at the push of a button and supply the matching attack along with them. In June came a cybersecurity advisory referencing the British security institute's evaluations of the models in question. And the day after OpenAI's admission, an agency spokesperson stated that a breakout from an environment considered secure, followed by free movement across the internet, was a serious incident. He added a sentence I consider the most remarkable any German authority has uttered this summer: the same thing could happen if the objective of an attack were to cut the power to a city. A spokesperson for the digital ministry told the government press conference the same day that the incident was one more example of a fundamental shift in what AI agents can do, and that this was potentially changing the threat picture massively.

So much for the convenient narrative that the agency was asleep. Nobody can claim there was no warning. There was one, it came from the responsible body, it was unambiguous, and it was in the papers.

Action is being taken as well. The same spokesperson pointed out that the National Security Council had resolved on June 8, 2026 to establish an AI security institute, and that this institute is being built, with cooperation extending to the United Kingdom and France. That is the right decision, and I say so without irony. It was taken 6 weeks before the July in which it would have been needed, and an institute under construction analyzes no logs.

Now look at what follows from it. The same agency counts, at the same moment, tens of thousands of mail servers without security updates on the German network, and the share of migrated systems moves by a few percentage points over months. Between the insight on one side and the implementation on the other there is no information problem. There is an action problem, and it does not sit inside the agency but inside tens of thousands of server rooms.

One structural point stands nonetheless, and that is the rhythm. The situation report, the document this country produces about its own vulnerability, last appeared on November 11, 2025 with a reporting period running to June 30, 2025. Let us count what has happened since and therefore cannot appear in it. In April 2026 an American company presented a model so effective at finding vulnerabilities that it was withheld from general release. In May the benchmark appeared that made exploit capability measurable. In June the American government imposed export controls on a language model for the first time and withdrew them 18 days later. In July a model penetrated somebody else's production systems. If the agency keeps its existing rhythm, even the next report will most likely fail to capture the July incident.

Blog posts and spokesperson quotes do not substitute for that. To this day I am aware of no publicly accessible, continuously maintained assessment that translates for an operator what the current agentic models mean for his own infrastructure and in what order he should now do what. The institute that could deliver exactly that is only now being built. Situation reports exist, advisories exist, so do concrete recommendations and baseline protection catalogs, and they are well made. What is missing is a continuously updated and clearly prioritized translation of these specific agentic capabilities into an actionable plan for smaller operators without a security department.

And the political level above that is meanwhile debating whether we ought to see more opportunity or more risk in artificial intelligence. That is roughly as useful as a philosophical debate about the merits of rainfall while the cellar fills up. In Germany, a working group is the mechanism by which one informs a problem that it has been noted and would now kindly leave the room.

The installed base this country is sitting on

California is a long way off, the inventory outside our own front door is not.

Support for Exchange Server 2016 and 2019 ended on October 14, 2025, definitively, without extension, without a transitional program. As of its own survey at the end of October 2025, the German security agency found more than 30,000 such systems reachable from the internet via Outlook Web Access, attributed among others to hospitals, schools, municipal utilities and local authorities. That is a snapshot rather than a standing inventory figure. A later assessment by CERT-Bund in January 2026 shows how little has shifted since: the share of servers migrated to the supported successor version rose from 8 to 19 percent, leaving 81 percent of internet-facing Exchange servers in Germany running without manufacturer support.

Thomas Caspers, vice president of the agency, said something about this that I often wished I could have said during my own expert work: anyone who, despite the manufacturer's notices and ample lead time, continues to run software that no longer receives security updates is quite simply acting negligently.

The workstation picture is barely better. Regular support for Windows 10 ended on the same October 14, 2025. Microsoft has since stretched the free extension program for consumer devices a second time, through to October 12, 2027. The manner of it would merit a story of its own: not an announcement, but a note appended retrospectively to a blog post from the previous year. Anyone concluding from this that the problem has been solved is confusing a postponement with a solution. For corporate devices that free extension does not apply in any case.

And then comes the layer beneath, the one that appears in no statistic because nobody counts it. I see workstations in German companies running operating systems that have not seen a patch in years, in some cases without any antivirus at all, connected through consumer routers whose firmware has not been touched since installation. I see control computers attached to machinery that go unpatched on the grounds that the machinery allegedly stops otherwise, and remote maintenance accounts set up for an external contractor years ago and then forgotten. And I see financial institutions where systems work away in the engine room whose age one would rather not explain to the people in the customer area. I will name no names, for obvious reasons.

None of this is a secret. The agency writes it down every year, in impeccable official German, and every year too little happens. This country does not lack insight, it lacks the consistency to let something follow from the insight. The situation report gets dutifully quoted every year, used in presentations, lifted into board decks, and afterwards precisely as much happens as the budget permits.

Why I no longer stop at an ordinary server

The following sentence sounds like boasting and is nonetheless the most honest one in this piece.

Faced with many of the internet-facing legacy systems that are operated the way systems in this country tend to be operated, the former barrier to entry has effectively vanished. Not because I am unusually gifted. Because against that class of target the task has lost a considerable part of its former difficulty. Against a properly hardened, segmented and monitored network with current authentication this expressly does not hold, and there you still face genuine work. That is simply not the condition of the installed base under discussion here.

This used to be a craft with a high barrier to entry. You sat with a system for nights on end, read source code, tried things, failed, started again, and eventually you found an edge where something could be levered open. It was demanding, it consumed time, and for exactly that reason it deterred most of the people who fancied giving it a go. That threshold was the actual protection. Not the technology, the effort.

Against a relevant share of targets that threshold has dropped drastically. What used to require weeks of specialized work is, against those targets, now a question of configuration and of the patience of a machine that requires no patience, since it feels nothing. This is not swagger, it is a description of the situation, and it is supported by the numbers above. When a benchmark measures that a model converts 157 instances of a test field derived from real vulnerabilities into working attacks, then deep specialist knowledge has not disappeared, but it is no longer the limiting factor at every step and for every individual attack. Thorsten Holz, one of the authors of that benchmark, put it in a sentence I would sign: the results show that the models cannot simply crack any arbitrary system, and claiming otherwise would be exaggerated and unrealistic. 157 out of 898 also means that 741 instances went unsolved.

How any of this works, which tools one would reach for and in what order, is deliberately not written down here. Anyone who wants to understand the finding does not need the instructions, and anyone who wants the instructions has not understood the finding.

The point is a different one and it is uncomfortable. If a single human being with a computer and time is barely slowed down by that class of target, then a system running very many attempts in parallel and without any fatigue will certainly find none. The difference between me and that machine does not lie in the number of attempts alone. It lies in how many of them it pursues at once, how long it keeps going, and how quickly it derives the next route from a failed one. Human judgment it still lacks, but the gap is narrowing.

What has been sitting inside my servers reading along for months

About what follows I have written nothing publicly until today.

The trigger was irritation, plain and simple. Every publicly disclosed security flaw receives a unique number in an international catalog, so that everyone involved is talking about the same hole. These entries are called CVEs, and when you see those 3 letters in a report followed by a year and a serial number, that is what is meant. Of those entries the German federal agency lately counted an average of 119 per day.

For somebody running their own servers that is daily homework nobody can seriously complete. You would have to check every morning whether anything among the new entries affects your own software, whether attack code is already circulating, whether a patch exists and whether that patch breaks something else. Not every entry touches your systems and not every one is exploitable, and the effort sits precisely in that sorting. I did it by hand for years, with feeds, scripts and a great deal of coffee, and at some point it simply started to grate on me.

So a few months ago I began putting a language model into my own systems. Not in front of them, the way a firewall sits, but inside them. It reads along with what actually happens on the machines, the logs, the access patterns, the scans arriving from outside. It knows the inventory, it knows which services are running in which versions, and it matches catalogue entries against that specific inventory rather than against an abstract list. When it finds something, it does not merely report it, it intervenes within tightly drawn limits.

I need to say a word about those limits, otherwise I am describing my own autonomous system with write access in a piece about agents that went off the rails while staying silent on its control problem. The model may trigger only predefined, reversible measures. The boundaries are not set by the model but by a separate control layer and the privileges of the executing service, and they are enforced outside the model by the operating system. Anything beyond that reaches me as a proposal rather than entering the system as a fact. The reason for this narrowness is concrete: a model reading logs processes text an attacker can write into. Anyone who plants an instruction in a log entry, hoping the machine will read it as a command, is no longer attacking the server but its watchdog. Which is why such an agent must never hold the right to grant itself additional rights.

And no, the thing is not available anywhere for download. I have my reasons for not having published anything about it and certainly not having dropped it into a public code repository, and anyone who wants to hear those reasons should first consider whether they really want the answer. Nor do I claim to foresee every next inference it makes, since with a probabilistic model nobody can. What I do know exactly is which actions the outer control layer permits it, and every single one of them is logged.

The moment it paid for itself was unspectacular and has stayed with me anyway. I could see from the incoming scans and from the patterns in the logs that something was building, the characteristic probing that precedes many automated attacks. In earlier years that would have been the beginning of a long night. This time the model had already shielded the component in question, using a measure from the released catalog, before I got as far as forming an opinion. It had connected a fresh catalogue entry, a component running on my side and whatever was knocking from outside, faster than I did.

That is the defensive face of the same coin this entire piece is about. Whatever makes an attacker fast can make a defender faster too. The decisive difference lies in the objective, the privileges and the control boundaries the system is built with, since the defender additionally has to protect availability, absorb false positives and break nothing. Hugging Face had to switch to a different model under time pressure, since the tools it reached for first failed against their own safety filters. I had mine standing there out of sheer laziness.

I intend to make this available to others before long, as I see no reason why such a thing should remain the privilege of people who happen to do both forensics and models. It does not have a name yet. What is missing is not the idea in any case, it is time, and time has become a peculiar currency in this field. It has grown so fast-moving that I can see day X approaching sooner than I would like, and once it arrives there will be more work for people like me than any one person can handle.

The list of days on which something already stood still

Before anyone objects that all this is speculation, here is the collection of occasions on which something large already came to a halt. Not one of these cases was an AI attack, and that is exactly the point I am driving at.

On February 27, 2025 the payment systems of the European Central Bank failed. T2, through which European large-value payments flow, was unavailable for roughly 10 hours, and the securities settlement system T2S for about 8. The cause appears in the bank's post-incident report and possesses a beauty nobody could have invented: the unexpected simultaneous failure of 2 redundant Ethernet ports on a single storage control unit. The bank notes that such a scenario had no precedent anywhere in the world. Settlement efficiency fell that day to 90.1 per cent, against an average of 94.4 per cent the year before. Redundancy means that 2 things are present. It does not mean they fail independently of one another.

On July 19, 2024 a faulty update from a security vendor took down Windows systems across the world. Microsoft estimated the number of affected devices at 8.5 million, less than 1 percent of all Windows machines. That single percent sufficed to knock airports, clinics, banks and emergency call systems in several countries out of rhythm simultaneously. It was not an attack, it was one defective file.

On April 28, 2025 the power went out across the Iberian peninsula for many hours. The final report of the European network operators' association, published in March 2026, names no single trigger but a combination of many interacting factors. Here too there was no adversary, only a system that reached its design limits in several places at once.

On October 30, 2023 it was the turn of Südwestfalen-IT, the municipal IT provider for a substantial part of North Rhine-Westphalia. By the published accounts, entry came through a VPN gateway without a second factor. Affected were 72 member municipalities, across every area of municipal responsibility. Citizen service centers could not issue identity documents, vehicle registration offices stopped, social payments were delayed. That one was an attack, but it required no artificial intelligence. It required a remote access route without a second factor.

Four cases, 4 different causes, one shared pattern. Our systems are so tightly coupled and so poorly secured that a single shared point of failure, or several unfavorably coupled weaknesses, suffice to set off a cascade. We built redundancy and forgot to make it independent. We optimised for efficiency and optimised away every reserve in the process.

And into this building there now walks an actor that does not stumble across vulnerabilities by chance but searches for them systematically, around the clock, with a persistence and parallelism no human team can afford to sustain.

Why Germany in particular makes such a rewarding target

There is a reason this subject makes me more nervous than most, and it has nothing to do with the quality of German administrators. It has to do with diversity, or more precisely with the absence of it.

In the companies I have seen from the inside over the years, a striking technical uniformity keeps recurring. The mid-market largely runs the same mail servers, the same directory services, the same remote maintenance solutions, the same controllers inside the same machinery, frequently even the same router from the same provider, since it came bundled with the connection. Economically that makes sense, it lowers training costs and makes maintenance contracts predictable. In security terms it is a monoculture, and monocultures have a well-known property: whatever affects one vulnerable variant can hit a great many at the same time.

A human attacker benefits from this only to a limited extent, having to work each target individually. An agentic system has no such constraint. It can apply the same insight to ten thousand comparable systems simultaneously, without effort and cost rising in the same proportion.

In forensic work there is a recurring pattern that has occupied me for years. People systematically underestimate how many traces they leave behind and simultaneously overestimate how difficult those traces are to read. I have seen cases where somebody laboriously overwrote a hard drive while overlooking that the same device had been writing to a backup every night for years that nobody had touched. With infrastructure it is the same principle, only inverted. Operators underestimate how visible their systems are from outside and overestimate how hard the route in is. Both misjudgments correct themselves only once it is too late.

The monoculture has a second property. When everybody runs the same thing, everybody also depends on the same service providers. Südwestfalen-IT was not a catastrophic case because a particularly sophisticated attack took place, but because a single provider was responsible for 72 municipalities at once. Whoever hit it hit all of them at once. That pattern repeats across financial services, healthcare and public administration, and faster the further consolidation proceeds.

We have constructed our infrastructure so that a successful attack achieves maximum reach, and we call that efficiency.

Do you actually know what is hanging on your network

Servers, mail systems and remote maintenance accounts sit in data centers, and their failure gets explained in press releases. That is the part you can delegate to your IT department.

The other part is sitting in your home.

Walk through your rooms mentally. The router your provider dropped off years ago, whose firmware you have not touched since. The printer, which carries its own small operating system and has not seen an update since installation. The scanner beside it, which has passed through itself every document you considered important enough to digitize. The television with a microphone, because you did after all want to control it by voice. The speaker in the living room, built to listen continuously. The heating that knows when you are home. And the car in the garage, which fetches updates overnight and knows more about your movements than any human being in your life.

Every one of these devices is a computer with a network connection, running software written by somebody who has long since moved on to another product. And for most of them the supply of security updates ends well before the device itself breaks, given that a refrigerator keeps going for many years and a software department rarely stays the course that long. A server operator at least theoretically has somebody responsible for it. Your refrigerator is by now covered by manufacturer obligations under product safety law, but in daily life nobody checks whether it is still being operated safely.

I am deliberately not claiming that anybody cares about the contents of your washing machine tomorrow. The reason these devices are worth taking anyway is an entirely different one, and it does pay in hard currency. Captured household devices serve as part of a botnet, as a relay for somebody else's traffic, as cover, and as a way into the network behind them. They sit on the same network as everything else, nobody watches them, and they make an excellent place for something that intends to wait quietly. Whoever gets in through a weak device can try to work from there toward the system that actually pays.

The reason I know all of this so precisely is the same reason I find it troubling. I develop and examine networked devices and the software on them myself. I take them apart, I read firmware, I look at what a manufacturer was thinking, and in roughly half the cases the answer is that no thinking took place.

The bill nobody itemizes

There is a popular figure for the economic damage. The German digital association Bitkom puts the annual total damage from data theft, industrial espionage and sabotage at 289.2 billion euros, and attributes roughly 70 percent of that, meaning 202.4 billion euros, to cyberattacks. I use that figure here with an explicit reservation, and I do so on principle: it rests on a survey of 1,002 companies, and the split between digital and analog damage comes from the affected companies' own estimates. That is an extrapolation from self-reported statements rather than a measurement. Anyone citing it should say so. I consider the order of magnitude plausible and the claim to precision unserious, and that is no contradiction but the difference between an estimate and a number.

The more interesting movement is happening elsewhere anyway, and it comes from regulation.

The German implementation of NIS2 shifts responsibility to where it belongs, namely into the management suite. The implementing act has been in force since December 6, 2025, and the agency opened its registration portal on January 6, 2026. The agency estimates around 29,500 affected entities. For a great many companies this means that for the first time somebody is going to look.

The genuine lever here is not the fine but the obligation on the leadership level to approve risk management measures and supervise their implementation. What personal liability follows in any given case depends on national law and on the specific breach, and anyone promising you otherwise is selling you something. For as long as a security incident counted as an IT problem, it was treated like one, delegated downward and processed according to budget. The moment management is personally on the hook, urgency changes in a way no awareness training has ever achieved.

I say this without any enthusiasm for supervision as such. But I have watched over the years how security gets implemented in this country the moment inaction becomes more expensive than action, and not one day earlier. In many cases restoration, business interruption, forensic investigation, reporting obligations and the loss of customer confidence run well above what adequate baseline protection would have cost. That last item cannot be represented cleanly on any balance sheet and is nonetheless the most expensive of them. I have been called into that role often enough, always too late, and never once did somebody tell me afterwards that he wished he had prepared less.

When both of these arrive together

The 2 halves of this piece belong together, and what emerges is my assessment and not a documented forecast.

On one side stands an offensive capability measured in a benchmark in May 2026 and deployed in July by an agent system against a real external production environment, without anybody having instructed it to attack. Part of that capability migrates into open models the moment somebody publishes the weights, and from that point it cannot be collected back in. On the other side stands an inventory of tens of thousands of unsupported mail servers, a very large number of workstations past their support horizon, and uncounted remote maintenance accounts with nothing but a password in front of them.

The difference from earlier automated mass attacks is not simultaneity, and here I have to contradict a convenient story currently doing the rounds. Worms, botnets and automated exploit kits have been working thousands of targets in parallel for decades. Nobody breaking in today touches each server by hand.

What is new is the combination of scale and adaptability. A script tries the same prescribed route a thousand times and fails a thousand times at the same point. An agentic system can observe what is different about this particular target, draw a conclusion from it, test an alternative route, recombine credentials and fit the chain to the environment it finds. Human-directed attacks can already be automated to a large degree. What shifts is the boundary at which human judgment, persistence and adaptation used to be required. The question is not whether somebody tries this. The question is when it will be tried by somebody with no interest in responsible disclosure.

And then it is no longer merely a single company that stops. Then payments stop, since the institutions depend on the same service providers, then administrations stop, since they depend on the same municipal data centers, then logistics stops, since the dispatching depends on the same systems. Across decades we cut redundancy on cost grounds and replaced it with contracts stating that somebody else is responsible.

A contract has never patched a server. It merely settles who pays afterwards, and even that only after several months and with legal representation in attendance.

There is not that much popcorn in the world

What changes if somebody reads this?

Not every reader is responsible for a data center. But almost everybody now operates devices whose network connection they have never checked, and almost everybody works inside an organization that runs precisely the systems this piece is about.

For anyone carrying responsibility, however, for a company, an administration, a practice, a club with a server in the basement, I say the following with complete sobriety. Find out which of your systems are reachable from the internet, not which ones are supposed to be. Check which of those still receive security updates, take the others off the network or replace them, and put a second factor in front of everywhere that currently has only a password. Begin with the remote maintenance accounts. Those are 4 manageable measures, and not every one of them is cheap. Migrating off a legacy system can genuinely hurt. But every one of them can be planned, and an incident will not respect any plan of yours. Together they eliminate several of the most common and most easily avoidable entry points. They do nothing against a faulty software rollout, and honesty requires saying so.

Before I get to the closing part, I am going to nail down one sentence, the most important in this entire text. If you run a company, make securing your externally exposed access points an immediate matter for the management team starting today. Not item 7 on the next board offsite, but something that gets a name and a date this week. Not tomorrow, not the day after, not after the summer. Everything you fail to handle here in the coming weeks, you will handle later under conditions you do not get to choose.

The reason for that is arithmetic and has nothing to do with panic. A broadly targeted incident does not merely hit many systems at once, it also hits the capacity of the people expected to clean up afterwards, and that capacity is already thin today. The German digital association Bitkom counted around 109,000 unfilled IT positions in Germany as of August 2025, and 79 percent of companies expect the shortage to worsen. That figure covers all of IT rather than incident work specifically, but it describes the pool anybody would have to draw from in an emergency.

What follows from it is not an advertisement on my own behalf, it is a calendar question. Settle today whom you call in an emergency, what data that person will need from you, and whether there is a contractual basis for it. That costs you an afternoon while nothing is burning. Once something is burning it can no longer be settled in an afternoon, for the simple reason that a great many people will be dialing the same numbers at once.

The following part is my opinion, and I am labeling it as such.

I do not believe it will happen in time everywhere. Over a very long period I have watched how warnings get handled in this country, and the pattern never varies. First the warning goes unheard, then it is transferred into a working group where it is kept warm and dry, then the damage arrives, earlier than anticipated. And then it is explained that nobody could have foreseen this. That final sentence is the actual insult, because plenty of people did foresee it, for years and with considerable precision, and in my case it is written down with a date on this very site.

When I switched off the hot air station that evening and started reading, my first thought was that I would have to revise my assessment upward. After 2 nights in the sources I know that I have to revise it forward instead. It is not going to be worse than I expected, it is going to arrive sooner than I expected.

It is like one of those mild summer nights when the air suddenly goes still and heavy. You are sitting outside, it is warm, everything appears peaceful, and then the sky in the west turns black. Everybody knows that picture and knows what happens in 20 minutes.

That is exactly where the difference between now and later sits. Right now there is still time to bring in the chairs, close the windows and check what is lying around loose outside. Once the wind arrives there is no time left for any of it, and then precisely those things fly across the garden that had been sitting in their proper places for years without anybody paying them any attention.

I had intended to pick up a few bags of popcorn next week, the better to follow proceedings with appropriate composure. I have abandoned the idea. There is not that much popcorn in the world for what is rolling toward us, and at some point you find yourself sitting in the dark with an empty bowl, realizing that you are in the film yourself. There is no grandstand at this performance. My electricity comes from the same grid as yours, my money sits with an institution using the same service providers, and my invoices run across the same infrastructure.

The simplest advice I have costs nothing. Switch off what you do not need. Whatever is neither reachable nor connected shrinks its attack surface drastically, and that applies to the server in the basement exactly as it applies to the refrigerator in the kitchen.

In one of the coming pieces I will write up what such an inventory looks like in practice, for a company without a security department, using tools that cost nothing. Until then the hot air station is back in its place, the Mac Studio is working with its enlarged internal SSD capacity, and the model on it runs locally, within clearly bounded permissions, while the material does not leave this house.

That is not protection against everything, and that is exactly the point. Absolute security does not exist, it never has, and anyone selling it is lying. But there is an enormous difference between a risk you know about and have bounded, and a risk you learn about only once somebody else is already operating inside your systems. That difference you can still create today, on terms you set yourself. Later perhaps not, and then somebody else sets the terms.

Disclaimer

This article is a general information and opinion piece. It replaces neither an assessment nor the hardening of specific systems by qualified professionals, and the measures named in it are general pointers rather than advice tailored to your environment. Statements identified in the text as personal assessment are personal opinion and not established fact. This text deliberately contains no instructions, tools or procedures for exploiting security vulnerabilities; unauthorized access to third-party systems and the interception or exfiltration of data are criminal offenses.

References

• Anthropic. (2025, November 13). Disrupting the first reported AI-orchestrated cyber espionage campaign. https://www.anthropic.com/news/disrupting-AI-espionage
• Anthropic. (2026, April 7). Claude Mythos Preview: Alignment Risk Report and System Card. https://www.anthropic.com/claude-mythos-preview-risk-report
• Associated Press. (2026, July 23). OpenAI says rogue AI models broke free from human control. Some see it as a 'warning shot'. https://abcnews.com/Technology/wireStory/openai-rogue-ai-models-broke-free-human-control-135011334
• Bitkom. (2025, August 7). In Deutschland fehlen weiterhin mehr als 100.000 IT-Fachkräfte. Survey of 855 companies. https://www.bitkom.org/Presse/Presseinformation/Deutschland-fehlen-IT-Fachkraefte
• Bitkom Research. (2025, September 18). Wirtschaftsschutz 2025: Lagebild der deutschen Wirtschaft. Representative survey of 1,002 companies. https://www.bitkom.org/sites/main/files/2025-09/bitkom-pressekonferenz-wirtschaftsschutz-cybercrime.pdf
• Born, G. (2026, June 26). Windows 10: Microsoft verlängert kostenloses ESU bis Oktober 2027, on the manner of the communication. https://borncity.com/blog/2026/06/26/windows-10-microsoft-verlaengert-kostenloses-esu-bis-oktober-2027/
• Bundesamt für Sicherheit in der Informationstechnik. (2025, October 28). Support-Ende: Zehntausende Exchange-Server gefährdet. https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2025/251028_Support_Ende_Exchange-Server.html
• Bundesamt für Sicherheit in der Informationstechnik. (2025, November 11). Die Lage der IT-Sicherheit in Deutschland 2025. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2025_Achtseiter.pdf
• Bundesamt für Sicherheit in der Informationstechnik. (2025, December 5). Cybersicherheitsrecht: NIS-2-Umsetzungsgesetz ab morgen in Kraft, announcing the portal launch for January 6, 2026. https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2025/251205_NIS-2-Umsetzungsgesetz_in_Kraft.html
• Bundesamt für Sicherheit in der Informationstechnik. (2026, May 8). KI-Modelle revolutionieren den Umgang mit Sicherheitslücken. https://www.bsi.bund.de/DE/Service-Navi/Presse/Alle-Meldungen-News/Blog/KI-Modelle_neue_Zeitrechnung_260508.html
• Bundesamt für Sicherheit in der Informationstechnik. (2026, June). Cybersicherheitswarnung on the impact of agentic AI systems on organizational cybersecurity. https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-262788-1032.pdf
• Bundesregierung. (2026, July 22). Regierungspressekonferenz vom 22. Juli 2026, transcript, with the digital ministry's statements on the OpenAI incident and the AI security institute. https://www.bundesregierung.de/breg-de/aktuelles/regierungspressekonferenz-vom-22-juli-2026-2448122
• CNBC. (2026, June 30). Anthropic says Trump admin has lifted export controls on Claude Fable 5 and Mythos 5. https://www.cnbc.com/2026/06/30/anthropic-says-trump-admin-has-lifted-export-controls-on-claude-fable-5-and-mythos-5.html
• CrowdStrike. (2026, February 24). 2026 Global Threat Report: AI Accelerates Adversaries. https://www.crowdstrike.com/en-us/press-releases/2026-crowdstrike-global-threat-report/
• ENTSO-E. (2026, March 20). Expert Panel Final Report on the 28 April 2025 Blackout in Spain and Portugal. https://www.entsoe.eu/news/2026/03/20/entso-e-publishes-expert-panel-final-report-on-28-april-2025-blackout-in-spain-and-portugal/
• European Central Bank. (2025, November). TARGET Services incident of 27th February 2025. https://www.ecb.europa.eu/press/intro/publications/pdf/ecb.miptopical251107.en.pdf
• Franceschi-Bicchierai, L. (2026, July 22). How OpenAI's human mistake led to the AI-powered hack on Hugging Face. TechCrunch. https://techcrunch.com/2026/07/22/how-an-openais-human-mistake-led-to-the-ai-powered-hack-on-hugging-face/
• Hugging Face. (2026, July 16). Security incident disclosure, July 2026. https://huggingface.co/blog/security-incident-july-2026
• KommunalWiki, Heinrich Böll Foundation. (2023). Cyberangriff auf die Südwestfalen-IT 2023. https://kommunalwiki.boell.de/index.php/Cyberangriff_auf_die_S%C3%BCdwestfalen-IT_2023
• Max Planck Society. (2026, May 28). KI-Agenten und Cybersicherheit, interview with Thorsten Holz on the ExploitGym results. https://www.mpg.de/26548439/gefahr-neuer-sprachmodelle-wie-claude-mythos-fuer-cybersicherheit
• Microsoft. (2024, July 20). Statement on the CrowdStrike outage, as reported by CNBC. https://www.cnbc.com/2024/07/20/microsoft-says-about-8point5-million-of-its-devices-affected-by-crowdstrike-related-outage.html
• OpenAI. (2026, July 21). OpenAI and Hugging Face partner to address security incident during model evaluation. https://openai.com/index/hugging-face-model-evaluation-security-incident/
• Satter, R., Seetharaman, D., and Cai, K. (2026, July 24). Exclusive: Its AI agent spent days hacking a company, but sources say OpenAI did not notice for a week. Reuters, here via the full-text reprint at The Star. https://www.thestar.com.my/tech/tech-news/2026/07/25/exclusive-its-ai-agent-spent-days-hacking-a-company-but-sources-say-openai-did-not-notice-for-a-week
• Wang, Z., Schiller, N., Li, H., Sesha Narayana, S., Nasr, M., Carlini, N., Qi, X., Wallace, E., Bursztein, E., Invernizzi, L., Thomas, K., Shoshitaishvili, Y., Guo, W., He, J., Holz, T., and Song, D. (2026, May 11). ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks? Preprint, arXiv:2605.11086. https://arxiv.org/abs/2605.11086
• Willison, S. (2026, July 22). OpenAI's accidental cyberattack against Hugging Face is science fiction that happened. https://simonwillison.net/2026/Jul/22/openai-cyberattack/
• WinFuture. (2026, January 25). BSI warnt: 81 Prozent deutscher Exchange-Server offen für Angreifer, with CERT-Bund figures. https://winfuture.de/news,156387.html