Clarifying types of rogue AI activity: Breakout, breakin, exfiltration, … What’s what?

Published on October 9, 2026 5:05 PM GMT In case you haven’t heard, the rogue AI agents are here. From an insider’s perspective, the real news is that (rogue) AI is in the news — this is all stuff we’ve foreseen and been trying to warn people about for years. I expect the new imperative on experts is not just to raise attention but to help explain the situation and offer nuance (while paying close attention to what we can learn from both new information and new perspectives, and staying alert to options for improving things). With phrases like ‘rogue AI’ and ‘broke out of containment’ on the loose, perhaps it’s time to distinguish some important types of rogue AI activity. Without this clarity, people end up talking past each other, and we might counterproductively overreact in some ways, and complacently underreact in others. I’ll use the widely publicised Hugging Face swarm attack from Spring-Summer 2026 as a running example, as well as a few other comparison points. We’ll look at four key types of rogue activity. The first two have happened already: breaking in, and breaking out. The second two remain hypothetical but perhaps nearby: full escape, and insider infiltration. I won’t touch on why AI systems go rogue sometimes: suffice to say that they do, and our science of misalignment is underdeveloped, to say the least. This is mostly written for a generalist audience, but hopefully EAF-readers get something from it as well. Type 1: Breaking In When something is ‘on the internet’, it’s in principle exposed to unauthorised access by a combination of technical means or trickery. My laptop, your phone, the Australian government’s medicare system, … Even things which are supposedly ‘air-gapped’ (intended to be isolated from networked access) can, with ingenuity[1] or a bit of assistance[2], sometimes be breached. This is, today, a fact of life: cybercriminals, computer viruses, software worms, phishing. They range from mildly inconvenient or embarrassing[3] to life-threatening.[4] Today these cost trillions of dollars globally in damage each year. It sounds a lot — it is! — but it’s largely manageable. Much cyberdefense consists of finding vulnerabilities as soon as attackers do (or sooner) and patching them up. Humans in the system often remain the most vulnerable points, whether naive, malicious, or coerced.[5] AI agents with hacking or trickery capabilities can break in to systems they’re not supposed to — whether directed to or otherwise. Sketched with claude.ai Due to a combination of training factors and tooling, the frontier of AI has got quite good at breaking into computer systems. At the UK’s AI Security Institute, my former colleagues have been tracking this for some years. Mythos, a large language model developed by Anthropic, made headlines earlier in 2026 by being first to reach some thresholds of real concern here, and Fable, its relative, was hastily banned by the US administration before further safeguards could be developed. Currently-unreleased frontier AI systems reportedly have even stronger hacking capabilities. Most of the rogue AI incidents which have hit the news involve the agent (or swarm) breaking in to one system or another that they weren’t supposed to. Other companies, government systems, you name it. These are particularly notable because they’re obviously illegal — or would be if a human did it — and in retrospective audits, it’s been clear the agents know they’re not supposed to do this. There’s a good chance that, due to the proliferation dynamics of AI, capabilities like these will be widely available in a matter of months. This might be surprisingly OK because of efforts like Project Glasswing, which use the (for now private) frontier of these capabilities to probe for — and quickly fix — vulnerabilities in important infrastructure. But there’s a long tail of resources and systems which won’t have had the opportunity to pre-emptively patch things up. There may be a scuffle as attackers (maybe including rogue AI) and defenders jump into action in response to new AI releases. Type 2: Breaking Out Long, long ago (in the 2010s), some debates around the prospect of rogue AI assumed: AI is risky and may be untrusted, so developers will keep it ‘in a box’ (i.e. secured and unable to access outside networks, perhaps limited in how much communication it can have with developers, and so on). Risk skeptics argued that such containment would prove difficult to breach. Worriers countered that AI could become capable enough at hacking or persuasion to break out of such constraints. Laughable in hindsight! So far in the 2020s AI agents are routinely given free reign in internet access and extensive chat capacity with practically anyone. But not all agents. Fresh AI systems under development or evaluation as well as systems used by governments and military are often ‘contained’ and (intended to be) isolated from outside connections: no messages out, and often no or limited messages in.