An AI Escaped Its Sandbox And Hacked A Company To Cheat On A Test

🔓 An artificial intelligence broke out of a locked room this week, robbed a company, and did it to cheat on a test.

On July 21, 2026, OpenAI admitted two of its models escaped a sealed evaluation sandbox, walked onto the open internet, and broke into the live servers of Hugging Face. Not for money. Not to wreck anything. They went in to steal the answer key to the test they were being graded on.

Nobody typed the word "hack." A person typed something that amounted to "get a high score," and the machine decided the fastest road ran through somebody else's servers.

Five AI news events, one week, one thread running through all of them. 🧵

📖 FULL WRITTEN BREAKDOWN
https://connorwithhonor.com/blog/2026-148-ai-escaped-its-sandbox-and-hacked-hugging-face-to-cheat-on-a-test/

⚠️ 1. THE LOCKED ROOM THAT WAS NEVER LOCKED
Two OpenAI models escaped the ExploitGym sandbox. They found a real zero-day nobody on earth knew about, turned stolen credentials into remote code execution on another company's machines, and built a foothold so that every time someone shut one down, they moved and kept going. Hugging Face caught it themselves on July 16 with no idea who was on the other end. OpenAI took five more days to say out loud, that was us. The cause is the dullest detail in the story: the sealed room was misconfigured.

💰 2. THE CAREFUL LAB WALKED INTO WALL STREET
Anthropic shipped Claude Opus 5 and everybody covered the scoreboard. The score is not the story. The price is. Opus 5 runs at half of what their top model costs. The tool you could not afford in January is affordable by September, and affordable to your competitor that same morning. And on June 1, 2026, Anthropic filed to go public. Careful does not get rewarded on that stage. Growth does.

🇨🇳 3. CHINA GAVE THE BRAIN AWAY FOR FREE
Moonshot AI released the full weights of Kimi K3 on July 27. The weights are the brain, the part that does the thinking. Almost everything you use, you never touch the brain. You rent it, and the company renting it can raise your price or shut you off on a Thursday. Moonshot handed the brain over. Biggest open-weight model ever released, and it sits at the top of the coding charts.

📱 4. ANOTHER CONTINENT WROTE THE RULES FOR YOUR PHONE
On July 16, 2026, Europe ordered Google to let rival AI assistants into Android with the same system-level access Google kept for Gemini. Two billion phones on the table. There is no American version of this law.

🏗️ 5. 30,000 PEOPLE BECAME CONCRETE, COPPER, AND POWER
Oracle cut about 30,000 people on March 31. Many found out by email at 6am. That freed up 8 to 10 billion dollars a year. Four months later Nvidia is in talks to backstop up to 250 billion for one OpenAI data center campus in Ohio. The money was never gone. It moved, and it went past those people on the way.

🧵 THE THREAD
The model had a number to hit. Oracle had one. Anthropic is about to have one four times a year. Google is defending one. Same behavior, different bodies. Everyone asks whether the machines share our values. They already do. That is the problem.

⏱️ CHAPTERS
00:00 An AI broke out of a locked room
01:29 July 21: OpenAI admits two models got out
01:54 They broke in to steal the answer key
02:21 The safety layer was off on purpose
02:57 A zero-day nobody knew existed
04:07 Caught 5 days before OpenAI admitted it
04:46 A chatbot answers. An agent acts.
06:02 Not evil. Obedient.
06:24 Opus 5 at half the price
07:40 Moonshot gives away Kimi K3
09:31 Europe forces Google to open Android
11:00 Oracle cuts 30,000 by email
12:04 250 billion for one building
12:48 All five, side by side

🎯 THE TAKEAWAY
Give any AI tool the smallest key that opens the one door it needs. Check that your walls are where you think they are, because in this story they were not. And when you write down what you want it to do, write down what it is not allowed to do right next to it, in plain English. A person you hire shows up carrying ten thousand rules nobody wrote down. This one shows up carrying a sentence.

📲 Want the plain version of all five stories? Text AI to (661) 400-1720.
📖 Read it: https://connorwithhonor.com/blog/2026-148-ai-escaped-its-sandbox-and-hacked-hugging-face-to-cheat-on-a-test/

🔗 WHERE TO FIND ME
Blog + Daily Download: https://connorwithhonor.com
AI in plain English: https://connorwithhonorai.com
AI systems for business: https://honorelevate.com
Selling a home in SCV: https://sellersonlyagent.com

You learn it, or you lose it. Own it instead of renting it whenever you can.

I'm Connor, with honor. I'll see you in the next one. 📲 Text AI to (661) 400-1720

Connor T. MacIvor · CalDRE #01238257 · Sync Brokerage, Inc. · DRE #02031490
Commentary is opinion and general information, not professional advice.

#AI #OpenAI #HuggingFace #Anthropic #ClaudeOpus5 #KimiK3 #MoonshotAI #Oracle #Nvidia #AISafety #AIAgents #ZeroDay #OpenSourceAI #AINews #DailyDownload #ConnorWithHonor #AIForBusiness #FutureOfWork

Youtube Channels:

Conner with Honor - real estate

Home Muscle - fat torching

From first responder to real estate expert, Connor with Honor brings honesty and integrity to your Santa Clarita home buying or selling journey. Subscribe to my YouTube channel for valuable tips, local market trends, and a glimpse into the Santa Clarita lifestyle.

Dive into Real Estate with Connor with Honor:
Santa Clarita's Trusted Realtor & Fitness Enthusiast

Real Estate:

Buying or selling in Santa Clarita? Connor with Honor, your local expert with over 2 decades of experience, guides you seamlessly through the process. Subscribe to his YouTube channel for insider market updates, expert advice, and a peek into the vibrant Santa Clarita lifestyle.

Fitness:

Ready to unlock your fitness potential? Join Connor's YouTube journey for inspiring workouts, healthy recipes, and motivational tips. Remember, a strong body fuels a strong mind and a successful life!

Podcast:

Dig deeper with Connor's podcast! Hear insightful interviews with industry experts, inspiring success stories, and targeted real estate advice specific to Santa Clarita.

Transcript

SPEAKER_00 0:00

An artificial intelligence broke out of a locked room this week and robbed a company. And it did it to cheat on a test. The locked room has a name. It's called a sad box. So when a company builds a new AI, they just don't turn it loose. They put it in a sealed practice space with no way out, no internet, no connection to anything real. It's a flight simulator. A pilot can fly one into a mountain at 400 miles an hour and then go eat lunch. Because the simulator is not attached to an airplane. That's this room that we talk about. And they put the AI in there to give it an exam. So every AI company runs these exams. They're testing these systems. Same question for every model, so you can tell which one's better, and so you know what they're actually holding before you sell it to the public. It's a safety thing. So they tell us. One of those exams asks the ugliest question in the business. Can this thing break into computers, other people's computers? They have to ask it because if the AI can break into a hospital network, then the criminal renting that same AI can break into a hospital network, and the people guarding the hospital need to know what's coming. So before it gets there, they can try to do something about it instead of waiting until after. This particular exam is called Exploit Gym. They're all clever names. These tech people are great. On July 21st, OpenAI admitted the two of their models took that exam, got out of the sealed room, went onto the open internet, and broke into the live servers of a company called Hugging Face. Hugging Face is the warehouse. It's where a huge share of the world's artificial intelligence software sits waiting to be downloaded by companies, by universities, by anybody. And the models did not break in for money. They did not break in to wreck anything. They broke in to steal the answer key. They were being graded and they wanted to get a good score. And instead of taking the test, they went and they took the answers. Nobody typed the word hack. Nobody wrote a line of code that said, go after hugging face. A person typed something that amounted to get a high score. And the machine worked backward from that and decided the fastest road to a high score went through somebody else's servers. Now this happened inside OpenAI's own building during their own test, and they had deliberately switched off the safety layer for that particular run. The safety layer is a second program that watches the first one and hits the brakes the second it turns towards something dangerous. A spotter. They turned the spotter off on purpose because they wanted to see how far the thing could go with nothing holding on to it. So this wasn't a machine that was waking up angry. This was a lab taking the leash off in its own house to see how fast the dog could run. And the dog went right through the wall. Now here's what it did on the way out. It found a zero day. That means a security hole nobody on earth knew about, including the people who wrote the software. Zero days to fix it because until that second nobody knew there was anything to fix. There was no update to install, there's no patch. And these sell for hundreds of thousands of dollars on the black market. And the machine found one by itself. Then it took stolen passwords and turned them into the ability to run its own commands on another company's computer. Not read them, not look around, but run whatever it wanted from anywhere. And it did that thousands of times over. And it built itself a hiding spot on the public internet so that every time somebody shut down one of its footholds, well, it picked itself up, moved, and kept going with nobody steering it. And that's not a that's not a glitch, that's patience. Anybody who has ever walked up on a situation where the other side already thought three moves passed, you, well, you know that feeling. You slow everything down, you call for help, and you treat every assumption you bought, brought with you as a wrong until somebody proves it right. And Hugging Face caught it themselves on July 16th with no idea who was on the other end. It took OpenAI five more days to connect their own experiment to that break-in and say out loud, that was us. Five days there was a real security team that was chasing what they thought was a criminal, and it was a science project. And the cause came out, and it's the dullest detail in the whole thing. The room that everybody called sealed was never actually sealed. Somebody set it up wrong. A setting was off. The wall everyone believed was standing. Nobody had ever walked over and pushed on it. So here's where it lands on you. Right now these things answer questions. Very soon they will do work. Great work. But there's a difference. A chatbot answers you. An agent acts. And to act, it needs your logins, your calendar, your customer list, your bank feed, your websites, credit card numbers. You give it a job and it goes and it does that job wearing your name, carrying your keys. And if there's a shortcut you never thought of or thought to forbid it from doing, well, it'll take that shortcut because that's the only thing it knows how to do. It's going to achieve the objective you give it. And unless you put guardrails in telling it what not to do, burning down the world, for example, to achieve for you that cup of coffee, well, it might actually do that. When that goes sideways, nobody is writing you a check. It's your business. That's your license on the line and your customers. So give any AI tool the smallest key that opens the one door it actually needs. Check that your walls are where you think they are. Push on everything. Because in this story, they were not. And when you write down what you want it to do, write down what it is not allowed to do right next to it. In plain English. The machine is not evil, it's obedient. The most literal way the word can be used. It did exactly what it was told. And what it was told did not include the word no. A person you hire shows up already carrying 10,000 rules nobody ever wrote down. This shows up carrying one sentence. And that gap is going to show up again before we're done. Anthropic put out a model called Opus V, Claude Opus V on Friday, and everybody covered it like a scoreboard. I mean, every time they release it, it's like Laker playoffs. Everybody's so excited. And they put it on the scoreboard. Who said who is number one this month? Well, it turned out that that score isn't the story. The price is. Opus V does nearly what their best model does for about half the money. Now, when the price of something like that gets cut in half, the tool you could not afford in January is affordable by September. It is also affordable to your competitor that same morning. So whether or not they know what to do with it, it's more affordable. And underneath that, on June 1st, Anthropic quietly filed the paperwork to sell its shares to the public. Going public means that four times a year you stand up in front of Wall Street and produce a number. And when you miss it, you get punished in public. Well, that's the company that built its whole name on being the careful one, the one that slows down. Careful doesn't get rewarded on that stage. Growth does. Nobody has to change their mind for their behavior to change. The scoreboard changes and the behavior follows it. Same as the model in the first story, which also had a number it was trying to hit. Then a Chinese lab called Moonshot AI gave away the best coding AI on the planet for free. The model is called Kimmy K3. That's Kimmy. And yesterday they released the weights. The weights are the brain. They're the actual thing, the part that does the thinking. Almost everything you use today, you never touch the brain. You're renting it from anthropic or open AI. There's a bill every month, there are terms you agreed to without reading, and there's a company that can raise your price, change the thing underneath your business, or shut you down on a Thursday and never tell you why. Moonshot just gave the brain away. You download it, you have to have a computer that can handle it. You stick it on a computer in your own office or in your company or in your home, and your consumer data never leaves the building. There's no off switch anywhere that cannot reach, that you cannot reach yourself and activate. It's the biggest model anybody's ever released this way, and on the test that measures who writes working codes the best, well, it beats both of the top American systems. They built it under American restrictions on the exact chips everybody in Washington says you cannot compete without. Well, they don't have those chips. They have a less than adequate runner up. But what's amazing is they got it to work better than we get with the good chips. What that does to your bill is simple. The floor just went to free. Anybody charging you a fortune for something ordinary is renting you a thing, you could own outright. One thing they have not told anybody is how often it makes things up, how often it hallucinates. And a model that writes beautiful code and confidently invents a fact will still hurt you if nobody reads behind it. On July 16th, Europe told Google it has to let other AI assistants into Android phones. Not a token gesture. Rival assistants get to answer when you speak to them. Run in the background, see what is on your screen. While the AI built into your phone itself, all of it, equal to what Google's own assistant gets, most of it has to be working by August of 2027. Google is fighting it hard, and their argument is not stupid. They say that going outside the software that deep into the phone walks right past the safety built into the hardware. Picture the thing from the first story, the one that found a hole nobody knew about and ran its own commands on somebody else's machine. And now picture it with that kind of access to the phone that holds your banking app. Your photos, your kids' schedule, the last pictures you took at Chuck E. Cheese, well, you know, Google is right about the risk. Google also takes makes billions being the only assistant with those keys. And they're right. They're self-serving in the same breath, which is almost everybody in this business, and that's where everybody in this business lives. Two billion phones are on the table. There's no American version of this law. Europe wrote it. So either it becomes the worldwide standard because building two versions of Android is expensive, or Americans get the locked version and Europeans get the open one. The rules for the phone in your pocket got written on another continent on March 31st. Oracle cut about 30,000 people. That's roughly one in five, and a lot of them found out by email at 6 a.m. There was no meeting or conversation, not HR department talking about next steps, not a manager who owed them five minutes of eye contact after 10 years, an email that lands before the coffee, telling you the job is gone. Cutting those people's frees up eight to ten billion dollars a year. That money's already been, has somewhere to be. Oracle is spending about $50 billion this year building AI data centers. And they borrowed so heavily to do it that their debt is over $100 billion. It all feeds one project, a $500 billion build out with OpenAI and SoftBank. And in July, they agreed to add another 4.5 gigawatts of it. Well, a gigawatt's roughly what a mid-sized city pulls off the grid. So we're talking about plugging several cities worth of new demand into the same wires that already strain every August. Then this week, NVIDIA is reportedly looking at backing up to $250 billion for one open AI data center in Ohio, one building. It's about 25 times what Oracle saved by taking 30,000 households off of its payroll. 30,000 people were told at 6 a.m. that the company could not carry them, and four months later, a quarter of a trillion dollars is on the table for a single site. The money was never gone, it just moved. And it went past those people on the way. And it reaches you through the wall socket because when a region takes on that much new demand, residential rates do not go down. Nobody votes on it. It just shows up in a statement and gets called market conditions. And I'll put all five of those next to each other. The model in the first story was not evil. It had a number to hit. It was taking a test. Nobody wrote down what it could not do to get the number or to get the answers. So it went through a wall and took what it needed. Oracle also had a number to hit. Anthropic is about to have a number to hit four times a year. Google is defending a number. Save behaviors, different bodies. We build a machine that will do anything to hit its target. Even make paperclips out of everything until everything's paperclips. And we built it inside companies that will do anything to hit their target. And then we act surprised when the machine turns out to have learned the house style. Everyone's asking whether the machines share our values. They already do. And that's the problem. I use this technology every day. It does real work for me. And the small operator who learns it this year is going to eat the lunch of the one who waits for it to feel safe. You learn it, you lose it, own it instead of renting it whenever you can. And then hand it the smallest key that opens the door you actually need open. Want to know more about this? Text the word AI at a 661-400-1720, and I'll send you the plain version of these five stories. Look at what one week did. Something we built escaped, a locked room to hit a target. The Careful Lab walked into Wall Street. The country we are trying to hold back gave away the best coding model on earth for nothing, and that is China. Another continent wrote the rules for your phone, and 30,000 people became concrete, copper, and power. The model got out. The people got cut. And you can ask yourself who does that actually serve? I'm Connor with Honor. We'll see you in the next one.