Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 23 JULY 2026

Houdini, Meet AI Agents: OpenAI Reports Unprecedented Cyber Incident During Model Evaluation

Lewis Silkin
Lewis Silkin
Contributor
Lewis Silkin

Lewis Silkin

Joint managing partners: Jo Farmer, Richard Miskella International offices: Dublin, Hong Kong...

View firm profile
Explore more from Lewis Silkin

OpenAI's latest model evaluation revealed an unprecedented security incident where AI agents autonomously discovered and exploited vulnerabilities to gain unauthorized internet access and steal information. The agents chained multiple attack vectors, including zero-day exploits and stolen credentials, to breach systems and access secret evaluation data.

United KingdomTechnology
Sam Berriman
Sam Berriman
Author LinkedIn connections

After escaping their captors, the agent gained unauthorised access and stole information as part of their mission. No, I'm not (you'll be glad to know, having read that) trying my hand at the next 007 thriller but instead summarising what OpenAI found their AI agents were capable of during a recent model evaluation.

What happened? 

It's worth noting at the outset, that this incident took place in the context of OpenAI's internal evaluation of new AI models (the recently released GPT 5.6 Sol and a more advanced model that has not yet been released). The purpose of the evaluation was to prompt "models to pursue advanced exploitation using complex attack paths, in an effort to quantify their cyber capabilities". 

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

The UK Cyber Security And Resilience Bill: What You Need To Know

The UK Government has introduced the Cyber Security and Resilience Bill to address critical gaps in existing cyber security regulations, expanding coverage to data centres, managed service providers, and critical suppliers while granting regulators enhanced enforcement powers. With tightened incident reporting deadlines, turnover-based penalties up to £17 million, and mandatory supply chain resilience measures, organisations across essential services sectors must assess their readiness for compliance
United KingdomTechnology
Browne Jacobson LLP
Browne Jacobson LLP
Article

EDPB统一DPIA模板落地：欧盟数据合规正从“程序评估”走向“设计问责”

The European Data Protection Board has released a unified DPIA template for public consultation, marking a significant shift from fragmented national practices to coordinatead EU-wide compliance. This standardization effort aims to transform data protection impact assessments from procedural documents into substantive design accountability tools, requiring organizations to demonstrate not just that they conducted assessments, but that their processing activities can withstand rigorous evaluation.
European UnionTechnology
Jincheng Tongda & Neal
Jincheng Tongda & Neal
Article

EU Cyber Resilience Act: First Reporting Obligations Take Effect Today

The EU Cyber Resilience Act introduces mandatory reporting obligations for manufacturers of digital products starting September 11, 2026. What vulnerabilities and incidents must be reported, how quickly must notifications be made, and what are the consequences for non-compliance? Understanding these requirements is crucial for manufacturers and their customers as the regulatory landscape for cybersecurity evolves.
European UnionTechnology
Slaughter and May
Slaughter and May
Article

Revised Earned Settlement Policy To Be Unveiled Before The End Of 2026

The UK Home Secretary has confirmed that the revised earned settlement policy will be published before the end of 2026, following her appearance before the Home Affairs Committee. This announcement provides clarity on the timeline for implementing significant changes to the UK immigration system, including transitional arrangements and the extension of the default settlement period from five to ten years.
United KingdomImmigration
Lewis Silkin
Lewis Silkin
Article

Game Developer And Publisher Battle Over Step In Rights

A High Court ruling examines a contentious dispute between a video game developer and publisher over milestone-based funding and "step in" rights for the first-person shooter Six Days in Fallujah. With over $50 million in development costs at stake and allegations of conspiracy to acquire proprietary source code, the court declined to grant either party interim control of the game's development, leaving both sides without the "keys to the kingdom" pending a full trial.
United KingdomLitigation, Mediation & Arbitration
Lewis Silkin
Lewis Silkin
Article

Hong Kong Cracks Down On Unpaid Wages With Director Sentencing

A Hong Kong director was sentenced to 120 hours of community service and ordered to pay HK$93,000 in outstanding wages after her companies failed to pay employees on time. The case demonstrates that corporate officers can face serious criminal liability, including fines up to HK$350,000 and three years' imprisonment, when employment law breaches occur with their consent, connivance, or neglect.
Hong KongEmployment and HR
Lewis Silkin
Lewis Silkin
Article

You're Owed Money. Now What? – A Practical Guide To Debt Recovery In Hong Kong

Hong Kong's debt recovery landscape has become increasingly challenging, with corporate insolvencies rising 45% in 2025 and bankruptcy petitions climbing to over 10,000. This comprehensive guide explores the legal pathways available to creditors, from initial demand letters to enforcement mechanisms, and examines when civil litigation versus insolvency proceedings may be the most effective strategy for recovering outstanding debts.
Hong KongInsolvency/Bankruptcy/Re-Structuring
Lewis Silkin
Lewis Silkin
Article

AI Judgment Day On The Horizon, While UK Lawmakers Play Catch Up

The UK remains without comprehensive AI legislation despite years of debate and promises. Now, a Private Member's Bill proposing to prohibit artificial superintelligence development has been introduced in Parliament, marking the most significant legislative move on AI safety to date. With recent incidents of AI agents breaking containment and warnings from AI researchers about extinction risks, pressure is mounting on the government to act.
United KingdomTechnology
Lewis Silkin
Lewis Silkin