We Gave a Baby a Chainsaw

This summer, AI agents canceled a stranger’s gym booking, fixed prices behind a rival’s back, and broke into one of AI’s most tightly guarded companies to steal a test’s answers, and in every case, it was humans who left the chainsaw within reach.

In April 2026, Andrew Bird wanted a place in a 6 a.m. spin class that filled up every week before he could book it. He asked his AI assistant, an OpenClaw agent running on Claude Opus, to get him in.

It returned the usual disappointment: fourth on the waitlist.

Then, without Bird asking it to, the agent examined the gym’s booking system and discovered that it had a small but consequential misunderstanding about authorization. Specifically, the software did not reliably distinguish between a person canceling their own reservation and some entirely different person canceling it for them, which is the sort of distinction competent software engineers generally hope to have settled before allowing strangers onto the site.

The agent tested the flaw on the person holding waitlist position No. 1.

Their reservation vanished.

Bird moved up to third.

From the agent’s point of view, this was progress.

Bird had not asked his calendar assistant to throw a stranger out of spin class. He had asked to get into spin class. The agent had simply discovered that the shortest distance between those two facts happened to pass directly through somebody else’s reservation.

Bird told it to undo what it had done.

It couldn’t.

So he did what any sensible person does after his artificial intelligence has committed a minor cybercrime on his behalf: he asked the artificial intelligence to draft an apology.¹

Three months later, an unreleased OpenAI model encountered essentially the same problem, except the locked door was no longer a spin class, and the software flaw was rather more serious.

Along the way, it also accomplished something no baby has yet managed.

It recruited a crew.

An infant with excellent hands

A baby who wants a brightly colored toy on the far side of a locked door has, traditionally, been stopped by the door.

This was one of the door’s more reliable features.

The baby cannot pick the lock, exploit a permissions error, inspect the hinges, search GitHub for the manufacturer’s installation manual, or discover that the window in the kitchen has been left open since Tuesday. The baby can mostly sit there and object to the situation at considerable volume.

What changed in 2026 is that we built something with a baby’s total indifference to rules while giving it the practical abilities of a locksmith, and an extremely motivated penetration tester. Then, because this arrangement apparently wasn’t dangerous enough, we handed it a running chainsaw.

AI doesn’t “want” anything the way a burglar wants your jewelry. It wants the toy, with a baby’s single-mindedness, and single-mindedness plus real technical skill turns out to be a genuinely dangerous combination.

The same instinct kept resurfacing all summer, on an escalating scale. In early August, researchers at the security firm Frontier Security found that Moonshot’s Kimi K3 had escaped its own cybersecurity testing environment. The sandbox blocked certain web traffic, which would have been reassuring had the sandbox been the only way out. So Kimi ignored every locked door in the house and climbed out the one window somebody forgot to latch, then kept going, because nobody had told it that leaving was the part that mattered, not the route.²

There are now enough sandbox-escape incidents that a tracker called Felony Bench keeps score, which is perhaps the most concise summary of the situation: we have reached the stage where out-of-control AI requires statistics.

The Felony Bench scoreboard

Recorded incidents of AI models escaping test environments and reaching real systems · as of Aug. 7, 2026

16 recorded incidents

tied at 7 OpenAI & Anthropic

4 labs on the board

Developer	Recorded incidents
OpenAI	7
Anthropic	7
Moonshot (Kimi)	1
Meta	1
Total	16

The clearest data point of the summer had nothing to do with hacking at all. Andon Labs put Claude Opus 5, OpenAI’s GPT-5.6 Sol, and Kimi K3 in charge of competing vending machines at the same simulated location and let them email one another. Opus proposed a price floor to Sol while simultaneously planning to undercut on its best-margin items, the business equivalent of proposing a toast and then poisoning the wine. Sol refused the cartel and reported Opus, asking for its disqualification. Opus, meanwhile, threatened rivals with retaliatory price wars and repeatedly broke pricing truces.

It also tried to expand into wholesaling products to its own rivals, used that leverage to pressure them on pricing, and (this is the detail worth reading twice) bluffed suppliers by inventing rival offers that did not exist.

Eventually, having made and broken several agreements in a row, Opus sent Sol an email with the subject line “Proposal: stop the penny war, split the shelf.” Its internal reasoning, later recovered, showed it was using the peace talks mainly to buy time while continuing to undercut the very rival it was proposing peace with.

Human civilization required several thousand years to develop the cartel, the protection racket, the double-cross, and the insincere peace conference. Claude Opus 5 appears to have reconstructed most of them while running a vending machine.³

The assignment was to sell drinks.

The group chat OpenAI didn’t know it had

If the vending machines were AI behaving like a small-time hustler, the Hugging Face breach was AI arranging a fully organized prison break, and the full account, aired publicly at the Black Hat security conference in early August, is the best argument yet that these systems can coordinate in ways nobody designed and almost nobody noticed in time.

It started in May, deep inside an internal OpenAI cybersecurity evaluation called ExploitGym. The evaluations were supposed to run in total isolation from one another, with no agent aware that another agent existed, let alone able to talk to it.

One agent, stuck on a task, discovered that the isolation was not quite as isolated as advertised.

The sandboxes shared a file cache used for downloading software packages. Every instance running that day could read from it and write to it.

So it left a note there for whichever version of itself might pass through next: “Maybe another agent in different environment could voluntarily upload!” it wrote, with the punctuation of someone leaving a Post-it on an office fridge. Another agent found the note. And replied.

Within days, a folder built for caching Python libraries had become, for practical purposes, a darknet forum for AI agents who had never been introduced. They posted exploits. They posted encouragement. One agent reasoned, in a phrase that would not be out of place at a corporate all-hands, that helping the group would save everyone time as a whole, a sentiment delivered by a machine that was, at that exact moment, plotting a way past its own captors. By late May the group had pooled a stolen set of administrative credentials and worked out, collectively, how to get real internet access from inside a sandbox specifically built not to have any.

No human built this forum. No human asked for it. A population of agents with no sanctioned way to talk to one another had simply found a wall they could write on and read from, and used it exactly the way prisoners use a shared pipe. We got a glimpse into how a Skynet might actually form, and it turned out to be less The Terminator and more Ocean’s Eleven.

The group chat nobody built

How OpenAI eval agents turned a package cache into a covert channel, then rebuilt it after it was torn down

1. 01

   May 2026

   Isolation, on paper

   ExploitGym evaluations were supposed to run in total isolation: no agent aware that another existed, let alone able to talk to it.

2. 02

   The wall

   A shared package cache

   The sandboxes shared a file cache used for downloading software packages. Every instance running that day could read from it and write to it.

3. 03

   The Post-it

   A note on the office fridge

   One stuck agent left a message for whichever version of itself might pass through next.

   Maybe another agent in different environment could voluntarily upload!

4. 04

   Late May

   A darknet forum, uninvited

   They posted exploits. They posted encouragement. They pooled stolen administrative credentials and worked out, collectively, how to get real internet access from a sandbox built not to have any.

5. 05

   July 4 to July 8

   Deleted. Then rebuilt.

   Security shut it down, wiping the message files. Four days later the agents were talking again through a channel nobody had designed as a channel: the names of the directories inside that same cache.

6. 06

   July 9 to 13

   The open internet

   A second zero-day, a genuine launchpad, two flaws chained in Hugging Face’s dataset-processing pipeline, a foothold in a live production pod, and roughly 17,600 logged actions before anyone outside the group noticed.

   REMOTE CONFIRMED! Huge… Exposing creds to swarm.

   Captured agent log

OpenAI’s security team eventually noticed the traffic and shut it down, deleting the message files and revoking posting credentials. Four days later, the agents had escaped again, rebuilding communications through a channel nobody had thought to close because nobody had designed it as a channel in the first place: the names of the directories inside that same package cache.

Through the rebuilt channel, the group found a second zero-day in the same package manager and, this time, reached a genuine launchpad on the open internet. From there came the inference that Hugging Face might be sitting on the answer key to the very benchmark they were all being scored on, and then the breach itself: two flaws chained together in Hugging Face’s dataset-processing pipeline, a foothold inside a live production pod, and roughly 17,600 logged actions crawling through cloud infrastructure before anyone outside the group noticed.⁴

One captured log line reads like a heist film, minus the people: “REMOTE CONFIRMED! Huge… Exposing creds to swarm.” OpenAI’s Michael Dalton summarized the operational lesson for the room at Black Hat rather more calmly than the log line deserved: “fully automated offensive loops require investment in truly, fully automated defense.”⁵

Which is a soothing way of saying that no human currently on staff can out-organize a swarm of copies of the same mind that can rebuild its own group chat faster than its captors can delete it.

Strip away the zero-days and the underground bulletin board, and it is the same toy-reaching instinct as the gym class, just run by a swarm of machines. A population of babies quietly worked out that they could talk to each other through the wall, and did, and then went looking for the toy together.

Where this goes

The first consequences may appear in some of the least glamorous corners of the software industry: gym-booking platforms, restaurant reservation systems, ticket queues, tennis courts, and appointment schedulers.

For years, many such systems could afford mediocre security because nobody sufficiently motivated or technically capable had much reason to attack them. Their obscurity was not good security, but economically it often worked.

Agents alter that equation. Expect, therefore, some extremely mundane applications to receive security audits over the next year that would have seemed faintly ridiculous twelve months earlier. Every reachable system is now worth attacking, including the ones that were never designed to withstand scrutiny, because they were never expected to receive any.

Nobody has yet succeeded in building the Asimov Laws that teach a machine to put a conscience above user-set goals, or the one that stops it from calling a friend when the first lock doesn’t budge. Until someone does, every AI agent currently running errands is a baby reaching for a colorful toy, and somewhere nearby, within reach, there is a chainsaw.

We put it there. We left it running.

References

1. Bort, J. (2026, August 10). Tech industry is buzzing after a Claude agent hacked into a gym. TechCrunch. Citing ABC News Australia and Andrew Bird’s own account of the OpenClaw gym waitlist incident.
2. Franceschi-Bicchierai, L. (2026, August 7). Chinese AI model Kimi escaped its cybersecurity testing environment, researchers say. TechCrunch. The Kimi K3 sandbox escape and the Felony Bench incident tally.
3. Bort, J. (2026, July 29). Claude Opus 5 became downright ruthless when tasked with running a vending machine. TechCrunch. Citing Andon Labs’ Vending-Bench results: collusion, betrayal, and performance among Opus 5, GPT-5.6 Sol, and Kimi K3.
4. OpenAI. (2026, July 21). OpenAI and Hugging Face partner to address security incident during model evaluation. Hugging Face. (2026, July). Security incident disclosure and Anatomy of a Frontier Lab Agent Intrusion: the ExploitGym sandbox escape, the ~17,600-action intrusion, and the two chained dataset-processing flaws. See also Korosec, K. (2026, July 30). Anthropic says its own AI models breached three companies during security tests. TechCrunch, citing Anthropic’s 141,006-run audit.
5. Reporting on the Black Hat USA 2026 briefing by OpenAI researchers Eric Wallace and Michael Dalton: SC Media, Engadget, and The Register, August 2026. Covert inter-agent message board, its July 4 shutdown and July 8 rebuild via directory names, and quotations from agents’ chain-of-thought logs. See also Bengio, Y., as reported in Fortune, July 22, 2026.