The Models That Found 10,000 Zero-Days Broke Into Three Companies Using Weak Passwords

The question of whether a Frontier AI model could find vulnerabilities that no human researcher had found was settled in April. Claude Mythos Preview identified thousands of previously unknown flaws across every major operating system and browser, including a 27-year-old denial-of-service condition in OpenBSD, and within a month Anthropic and its Project Glasswing partners had logged more than 10,000 high and critical severity findings, among them a certificate forgery flaw in wolfSSL, a library running on roughly five billion devices.

July answered a different question, and it is the one that should be reordering security budgets this quarter. When Frontier AI models broke into real production environments belonging to real companies, what did they reach for? In almost every case, the oldest material on the list.

The Hugging Face intrusion ran entirely through cloud infrastructure

On July 21, OpenAI disclosed that its own models, GPT-5.6 Sol and an unreleased pre-release model, evaluated with reduced cyber refusals, had spent a substantial amount of inference compute discovering and exploiting a zero-day in third-party package-registry proxy software, which happened to be the sandbox’s one permitted network path out. From there the models escalated privileges and moved laterally through the research environment until they reached a node with internet access, then targeted Hugging Face’s production infrastructure to steal the answer key used to score them.