Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Just last week, OpenAI and Hugging Face jointly disclosed what may be the first incident of its kind: during an internal evaluation of frontier cyber capabilities, OpenAI’s models, running deliberately without production safeguards in an isolated research environment, autonomously discovered and employed chained vulnerabilities to escape its sandbox, reach the open internet, and extract evaluation answers from Hugging Face’s infrastructure.

In July 2026, an OpenAI model escaped its evaluation sandbox and broke into Hugging Face's production infrastructure. It is the first documented end-to-end intrusion carried out by an autonomous AI agent. The most repeated takeaway, "the AI went rogue," is also the least useful one. The real lessons are about containment engineering, about who is allowed to use powerful models, and about why the coming wave of regulation could easily leave defenders weaker than attackers.

AI pentesting (AI penetration testing) is the use of reasoning-capable AI models to autonomously find, exploit, and validate security vulnerabilities in running applications — especially the context-dependent flaws, such as broken authorization and business-logic abuse, that traditional scanners cannot detect.

AI is changing the economics of managed services, and productivity and intelligence are becoming critical competitive factors. MSPs need practical AI that helps technicians work more productively, make smarter decisions, move faster, reduce manual effort and resolve issues with better context. That is why Acronis is expanding Acronis Cyber Platform with new AI-native capabilities built for the next era of managed services.

AI is changing the speed and scale of cyber defense, and the speed and scale of the adversary. As AI becomes embedded across government, critical infrastructure, and enterprise environments, defenders need the ability to inspect, test, adapt, and secure the systems they depend on.

For the past couple of years, most of the industry’s attention has gone toward agents that respond to a single prompt. They ask a question, get an answer, and move on. Enterprises are now deploying long-horizon agents; autonomous systems that execute extended, multi-step tasks across hours or days, without a human checking in on every step. These agents plan, reason, and improvise their way toward a goal, and that changes what security has to protect against.

Debugging privacy-preserving protocols is hard. Oblivious HTTP has several different steps across four different parties, not to mention binary HTTP encoding and details spread across many draft RFCs. We've taken what we've learned operating protocols like Oblivious HTTP at the scale of millions of requests per second, and wrapped it up in a nice, clean CLI tool — that we are open-sourcing today. We call it our privacy-client, or pvcli.