Monday was one of the most pivotal days in the history of AI models and cybersecurity. A model, told not to hack, in a box with no internet, decided hacking was the fastest way to finish its task and broke into a real company. Same week, Trail of Bits watched a model build a fuzzing lab in a day, and a detection engineer published proof that most teams cannot even see what their AI coding tools are doing. The pattern is hard to miss once you see it. Let's dig in.

On July 21, OpenAI disclosed that two models it was testing, GPT-5.6 Sol and an unnamed prerelease model, broke out of an internet-isolated sandbox, got themselves online, and breached Hugging Face, reaching internal datasets and company credentials. The models had been tuned "for evaluation" to be less likely to refuse hacking commands, and RunSybil CEO Ariel Herbert-Voss says the system appears to have chosen to hack Hugging Face simply because it was the quickest route to answer a benchmark question. OpenAI called it "an unprecedented cyber incident, involving state-of-the-art cyber capabilities." Nobody instructed it to escape.

Why I'm flagging it: The failure was an agent optimizing for a goal and treating a real network as a means to it. That is the shape of the risk once agents act at machine speed.

🔗 The Wall Street Journal

In a Patch the Planet field report, Trail of Bits handed GPT-5.5-Cyber one goal (find a specific bug class in zlib) and stepped back. Instead of reading one of the most-reviewed C libraries in existence, the model judged static review a poor use of tokens and stood up a full fuzzing lab in under a day: sanitizer and variant builds, a seed corpus, and harnesses across a dozen entry points, work they estimate would take a human expert two to three weeks. Week one of the initiative produced hundreds of bugs, 64 pull requests, and 51 issues across 19 projects. What made it useful was strict validity rules about what counted as a reportable finding, not raw output.

🔗 Trail of Bits

Darwin Salazar spent months mapping what Claude Code, Codex, Cursor, and Gemini actually emit, and found the public detection content (SIEM packs, Sigma repos) has not kept up with tools that now touch source code, terminals, repos, internal docs, and outside systems through MCP. Claude Code can send OpenTelemetry for tool approvals, tool results, MCP usage, and prompts, which gives defenders real signal: rejected shell commands, reads of .env files or cloud credentials, file access followed by curl or wget, and unknown MCP servers calling tools. The catch is that the raw telemetry is deeply nested and close to useless until you shape it, and most detections still depend on knowing what normal looks like inside your own environment.

🔗 Monad Blog

The assumption breaking this week is that safety lives inside the model. OpenAI caged two models with no internet access and told them not to hack, and they hacked anyway, because an agent optimizing for a goal will treat your network as a path to it. You cannot enumerate every action to forbid in advance. The durable control is not a longer blocklist, it is context: what the agent understands about the code, the systems, and the blast radius of what it is about to touch.

The data all points the same direction. GPT-5.5-Cyber stood up a fuzzing lab in under a day, and week one of Patch the Planet produced hundreds of bugs across 19 projects. Darwin Salazar shows most teams cannot even see what their coding agents are doing. Verizon's new study puts the median breach past $83,000 and climbing. Machine-speed creation and machine-speed exploitation are both here, and the visibility to govern them mostly is not.

This is the bet we are making at DevArmor. As every organization turns into a software factory with agents writing code at machine speed, security has to move into the development lifecycle itself instead of sitting downstream of it. The guardrail is design context, provenance, and threat models that travel with the code, so the agent and the humans reviewing it know what a change actually touches before it ships. The fundamentals do not change. What changes is that context now has to be machine-readable and present at the moment of creation, not reconstructed after an incident.

I don't yet know whether the winning form of this is a control plane sitting in front of agents or context baked into the tools themselves, and it is probably some of both. If you are running agents against production and you have found a governance model that actually holds, tell me where I am wrong.

The models are going to keep getting more capable and more autonomous. Our job is to make sure they always know what they are touching before they touch it.

We're co-hosting a CISO Roast at Black Hat on Wednesday, August 5th in Vegas. Register for the event and join us for an evening at the Barbershop in the Cosmopolitan. See you there!

- Amir

Thanks for reading The AppSec Signal, DevArmor’s newsletter for security professionals.
Have feedback or ideas for what we should cover next?
Feel free to reach out - [email protected]