How are AI models able to autonomously hack others?

xwhatsapp-strokecopylinkgoogleAdd Al Jazeera on GoogleinfoBy Hanna Duggal and Mohamed HusseinPublished On 29 Jul 202629 Jul 2026Last week, two of OpenAI’s most advanced AI models were reported to have “escaped” a controlled testing environment and hacked Hugging Face, a totally separate AI company, moving from one computer system to another to complete their task.

This is likely the first incident of an AI “agent” – an AI system that can make decisions and take actions – acting autonomously, offering a rare glimpse into how these systems can plan, adapt and pursue goals with minimal human intervention.

Al Jazeera breaks down what happened, how AI agents are able to act independently, and what that might mean for the future of AI safety.

OpenAI decided to test the autonomous abilities of its models by removing standard safety measures to see what would happen. The experiment was carried out in an isolated internal virtual testing environment known as a “sandbox” which has no access to the internet, and which it calls “ExploitGym”.

Below is a play-by-play account of events during the OpenAI-Hugging Face incident.

In order to understand how AI agents work, it’s important to differentiate them from traditional AI chatbots.

Generative AI creates text and images based on human prompts, while AI agents go a step further by making decisions and taking actions independently in pursuit of a specific goal, similar to a human being. This is known as “agentic AI” because the model has agency.

According to academics at the MIT Sloan School of Management, AI agents build on the abilities of large language models (LLMs) – generative AI models – by allowing them to complete tasks, not just generate answers.

For example, if you ask a traditional AI model to find the cheapest flights, it will provide you with a list of options it has sourced on the internet. An AI agent will strive to compare the flights, check them against your budget and preferences, and, with your permission, book the best option for you.

This shows that while generative AI provides information, AI agents can also make decisions and take action to achieve a goal without necessarily being prompted to.

To show how AI agents work towards a goal, the Sense, Plan, Act, Evaluate (SPAE) loop can be drawn upon. Originally developed in robotics, this describes a continuous cycle in which an AI agent gathers information, decides what to do next, takes action and checks the results before repeating the process. That process looks like this:

Incidents like the OpenAI-Hugging Face one have raised concerns about the potential for extreme capabilities of AI systems.

This is all valuable. Agentic AI’s market value is expected to grow from $5.1bn in 2024 to $47bn by 2030, according to Statista, in a clear indication of how quickly it is being adopted.

AI developer Anthropic urged the industry last month to slow the advance of the most powerful systems, saying that the speed at which AI models are carrying out tasks is too rapid. Last week, US Congress members put forward a bipartisan bill which would require developers of AI systems to create a “kill switch”, meaning these advanced models could be shut down if they posed a catastrophic risk.

Anthropic’s warning came a week after researchers at the University of Toronto carried out tests showing that AI could create a “worm” capable of adapting how it hacks while moving from device to device until it eventually takes over a computer network.

These dystopian-sounding developments came in advance of OpenAI boss Sam Altman saying on Saturday that AI has reached “the singularity” referring to the point at which AI surpasses human intelligence and becomes increasingly difficult to control.

Sean O hEigeartaigh, a research professor at the University of Cambridge, told Al Jazeera that he does not believe singularity has been reached quite yet.

“By the definition I’m familiar with, the singularity is the hypothetical point where AI is so capable and advancing so fast that it is transforming civilisation in ways we cannot control or predict,” he explained.

“This would most likely be through AI rapidly designing future generations of AI: recursive self-improvement. We aren’t there yet.”

However, he added: “The most advanced current models frequently make efforts to avoid being shut down in evaluation tests, and more capable future models will be better at bypassing ‘kill’ switches.”

Altman argued that such rapidly advancing AI is good for the world, but his comments have prompted further concerns about a new reality in which AI systems become unstoppable. How much of that is true and how much remains in the realms of science fiction is up for debate.

Concerns about AI range from the notion that it could “want” to “take over”, to making its own long-term plans, controlling the internet and operating infinitely.

While not quite amounting to full control of the internet, another theory, known as the dead internet theory, supposes that the World Wide Web will in the future mostly be filled with automated bots and AI-generated content rather than authentic human activity.

Many concerns raised by academics, however, are centred less on agentic AI’s intelligence, but on its ability to make judgements. MIT researchers have highlighted that “hallucinations”, which describe moments when an AI agent relies on the wrong data, can lead to grave mistakes. The Center for Strategic and International Studies (CSIS) echoed this, saying “a system might be smart enough to execute a task perfectly yet fail to realise that a sudden change in the local situation makes that task a catastrophic mistake”.

Another concern that has been echoed for a while is for the labour market, if AI becomes too capable. A study by MIT, carried out in November, found that agentic AI could already replace more than 10 percent of US jobs.

The graphic below highlights some of the common misconceptions and fears about AI and the current reality.