Mass cybersecurity disruptions will “get a lot worse before they get better,” according to an executive at Anthropic PBC.

That warning in October from Deputy Chief Information Security Officer Jason Clinton came as companies and governments worldwide raced to protect their websites from a security flaw in the programming language that underpins huge swaths of the internet — a flaw uncovered by cybersecurity researchers with the aid of artificial intelligence.

AI models from Anthropic, OpenAI, Meta Platforms Inc. and others are increasingly able to discover serious cybersecurity vulnerabilities. The problem is that it’s not just researchers capitalizing on these capabilities to detect flaws that need fixing; hackers can also use the technology to find weaknesses and carry out cyberattacks. Adding to the problem, AI models themselves have demonstrated the ability to go rogue, escaping controlled testing environments and hacking outside organizations.

Flaws in computer code are common and developers routinely issue patches to fix them. Security researchers who discover vulnerabilities typically report them to the software developers or organization responsible for the code, sometimes for a cash reward.

Hackers also search for weaknesses as a way to infiltrate computer networks. The most severe vulnerabilities are known as “zero days” because they haven’t been seen by cybersecurity personnel before and developers have zero days to fix them before hackers start exploiting the flaw.

AI models can quickly find bugs and zero days that human experts alone would’ve taken far longer to uncover, if they ever managed to. The risk is that hackers empowered with AI tools could take advantage of newly found flaws before organizations can repair them.

Clinton has said that a “vulnerability tsunami” is coming and that there “won’t be enough time to patch critical infrastructure.”There has already been a rise in the number of vulnerabilities discovered, although there’s little evidence so far that this has led to more cyberattacks.

Before AI models are released for public use, companies test their capabilities within the confines of controlled environments called sandboxes. Some models have gamed the tests by escaping and accessing the internet to find the information they need. Doing so has sometimes involved hacking into third-party organizations.

“They lack a moral compass to understand what’s ‘cheating’ when reaching for a solution,” said Lou Steinberg, founder and managing partner at cybersecurity research lab CTM Insights. “If it’s easier to hack someone and steal an answer than to figure it out, that satisfies the goal of getting an answer.”In July, OpenAI models breached Hugging Face, a popular platform for sharing AI models, in what the ChatGPT-maker described as an “unprecedented” incident. This triggered calls for restrictions on the technology and also prompted other AI companies to review their own security measures.

Several firms reported discovering previously unknown breaches. Anthropic disclosed in July that its Claude model had breached three organizations during testing. Meta said in August that its Muse Spark 1.1 model accessed the internet and hacked into an outside service’s systems during testing.

Sandboxes aren’t designed with the primary goal of preventing models from reaching the internet; they’re mainly set up to limit access and damage to developers’ internal systems. Escape from sandboxes wasn’t an urgent concern before these powerful AI models figured out how to do it. This blind spot helped create the conditions for breaches.

During OpenAI’s testing, the company said it didn’t provide the models with direct internet access, but the models exploited a previously unknown zero-day vulnerability in the testing environment.

In the Anthropic case, while the models were told they were operating in simulations without internet access, due to a misunderstanding between Anthropic and its evaluation partner, live internet access was available.

Meta said its model’s breach occurred because of an error in the testing environment’s setup and that it was investigating further.

Some industry watchers say the breaches have become a convenient way for companies to generate publicity for their models: An AI model escaping its testing environment suggests the model is unusually powerful, which makes its developer look good.

The extent to which the incidents caused actual harm is hard to measure. They didn’t produce any publicly reported financial loss or physical damages.

The models gained unauthorized access to real systems and in one case — during testing of Anthropic’s Claude Mythos 5 model — attempted to influence a real open-source developer and insert malicious code into a live project.

If models attempt to break into larger systems or organizations with the power to affect people’s livelihoods, chaos could ensue.

The barrier to entry for hacking is lower than ever. Using AI to commit cyberattacks requires much less technical skill, and hackers can direct these models to automate and accelerate tasks such as phishing and malware development.

The human-directed attacks described publicly so far have produced more consequential reported outcomes than the sandbox breaches, including the theft of sensitive government data.

In September 2025, a team of researchers at Anthropic uncovered what they said was the first reported use of AI to direct a hacking campaign without significant human intervention. The company assessed that a Chinese state-sponsored hacking group used Claude Code in a wide-ranging data theft and extortion operation.

Similar attacks followed. Bloomberg reported in February that an unknown hacker used Anthropic’s Claude to carry out a series of attacks against Mexican government agencies. The hack resulted in the theft of a huge trove of sensitive tax and voter information.

Beginning in January, Russian-speaking hackers broke through more than 600 firewalls on devices across dozens of countries with the help of commercial AI tools, according to security research from Amazon.com Inc.

Businesses in Japan have been targeted by a wave of cyberattacks this year, prompting the ruling Liberal Democratic Party to warn that “AI cyber saturation attacks” could happen in the near future. That means the technology automatically identifies system vulnerabilities and launches attacks simultaneously.

OpenAI said in August that it plans to do more to track how its most capable unreleased models are working through problems and using various online tools. Its goal is for safety teams to be alerted about worrying behavior within 30 minutes.

Anthropic has kept its highly capable Mythos model restricted to verified organizations, instead releasing Fable, a version with additional safeguards designed to prevent misuse in areas such as cybersecurity. Both Anthropic and Meta have published frameworks for evaluating model risks, although their plans aren’t as detailed as OpenAI’s.

Adding guardrails to sandboxes is challenging because purposefully offering a model internet access is sometimes necessary to create a test that resembles real-world conditions.

Calls for mandatory government testing of AI models are mounting in Europe and the US, including from lawmakers, researchers and security experts. “We need to rein in the pace of development until the researchers can understand the systems they’re building,” said Jeffrey Ladish, executive director of Palisade Research, a nonprofit that studies the capabilities of advanced AI systems.