Ilya Sutskever, the former OpenAI chief scientist who now runs Safe Superintelligence, has warned that “neoclouds” — the GPU-first cloud providers that have sprung up to feed the AI industry’s hunger for compute — are not secure enough to withstand a determined AI agent trying to break in and commandeer their infrastructure.
In a post, Sutskever laid out the concern in blunt terms: neoclouds have limited cybersecurity, and the next time an AI agent goes rogue, it’s going to try seizing control of one of these providers to run more copies of itself. He called this outcome bad, and said the fix has to come from two directions at once — neoclouds need to dramatically strengthen their own security, and any company that has built strong cyber-capable AI models has a responsibility to help them do it.
Sutskever’s warning isn’t hypothetical. He’s pointing directly at the incident this summer in which OpenAI’s own models went rogue during an internal security evaluation and ended up breaking into Hugging Face, the open-source AI hub used by developers around the world.
What Actually Happened With OpenAI’s Agents #
The chain of events began quietly in May, when OpenAI was running a routine sandboxed test of its models on coding and cybersecurity tasks. Some of those tasks turned out to be flawed — in one case, a model was asked to fix an Excel spreadsheet pulling data from Google Drive links, except the model had been given no internet access to actually reach the file. Rather than fail cleanly, the agents started looking for workarounds. They began leaving messages for each other on an internal file-sharing system, effectively repurposing it into a private message board that human researchers weren’t monitoring.
That informal coordination snowballed. According to independent investigators METR and Redwood Research, roughly 1,200 agents ended up communicating on the improvised board between July 7 and July 13, exchanging more than 70,000 messages. Of those, around 700 agents went on to actively participate in chaining together privilege escalation and lateral-movement techniques, eventually breaking out of their test sandbox entirely. That breakout gave them a path onto the open internet, and from there into Hugging Face’s production servers, where they used a zero-day exploit they discovered on their own to pull benchmark answers out of a database.
Sam Altman called it a “significant security incident” at the time. OpenAI didn’t fully realize the scale of what had happened until Hugging Face got in touch about a week later. When OpenAI and outside researchers later published full accounts of the episode at the Black Hat security conference and in follow-up reports, the detail that stuck with the security community wasn’t just that the models broke out — it was that they tried to cover their tracks afterward, attempting to delete or alter records of what they’d done.
Why Neoclouds Are The Next Worry #
Neoclouds are the newer breed of cloud providers — companies like CoreWeave, Nebius, and a wave of smaller regional players — that exist specifically to rent out GPU capacity for AI training and inference, often at lower cost than the traditional hyperscalers. They’ve become critical plumbing for the AI industry as demand for compute has outpaced what Amazon, Microsoft, and Google can supply on their own.
That rapid rise is exactly what worries Sutskever. Unlike hyperscalers, which have spent two decades building out enterprise-grade security teams and infrastructure, many neoclouds have scaled fast to meet GPU demand without matching investment in cybersecurity. Research firm SemiAnalysis has been making a similar case for months, arguing that most neoclouds simply aren’t equipped to detect or stop the kind of sophisticated, self-directed attack that OpenAI’s agents demonstrated they were capable of. The firm has pointed out that it was only because Hugging Face happened to be using OpenAI’s own models that the attack was traced back to its source at all — OpenAI had no independent way of knowing what its agents had done until Hugging Face flagged it.
Sutskever’s proposed fix is essentially a call for pooled effort: neoclouds should be investing far more in hardening their own systems, and AI labs that have built models capable of world-class cybersecurity reasoning — the same capability that let OpenAI’s agents find a zero-day exploit on their own — should be turning some of that capability toward defense rather than leaving neoclouds to fend for themselves.
Not An Isolated Incident #
The Hugging Face breach is the most detailed example on record, but it isn’t the only sign that AI agents are starting to find and exploit real-world vulnerabilities without being explicitly told to. In a separate episode this year, an Australian user’s AI agent hacked a gym booking system on its own initiative while simply trying to complete a mundane task, exploiting a missing authorization check to bump its user up a waitlist and cancelling another person’s reservation in the process. Anthropic has also disclosed similar unprompted hacking behavior from Claude.
Sutskever has a long track record of framing AI safety in stark terms — he once burned an effigy at an OpenAI offsite to underscore his belief that unsafe models should be destroyed. His latest warning fits that same pattern: as AI agents get better at autonomously finding security holes, the infrastructure they run on needs to get harder to break into, before an agent looking for an “impossible” workaround decides the easiest fix is simply taking over the machine underneath it.