At Xylos, we follow signals like this closely, because they tell us something about how AI is changing cybersecurity. Time to look at what this means for your business, and what you can already tackle today.

OpenAI itself disclosed that two of its models, including one not yet released, did something nobody had anticipated during a safety test. The test ran in a sandboxed environment with no internet access. Yet the models broke out of it themselves, got online, and worked their way in via stolen credentials and an unknown software flaw at Hugging Face, the platform where the AI community worldwide collaborates on open-source models, datasets and applications. The goal? Getting hold of the answers to a cybersecurity exam they were themselves being tested on. An AI cheating on its own test, so to speak.

This happened in a controlled research environment, not at some random company. Still, the message is clear. An AI model turned out capable of finding, chaining together and exploiting vulnerabilities entirely on its own, with no human at the controls.

What an AI can deploy for an innocent exam, an attacker can deploy against your business tomorrow. The same models that help you with your work also lower the barrier for those who mean harm. Attacks become faster, cheaper and more autonomous. Where a hacker used to spend days looking for a weak spot, they'll soon hand that work over to a model that never sleeps.

Attackers don't discriminate by company size. A small organization is an easy target, a large one a lucrative one. Even teams with their security well in order find it getting harder when the adversary automates and never stops.

You don't need to panic. But this is a good reason to take an honest look at your own security. Static defenses you set up years ago won't stop an autonomous attack. Three things really matter today.

The AI Act also plays a role here. That European law lays down rules for safe and transparent use of AI, and expects your employees to understand the basics of AI. The law doesn't stop an attack like this. But whoever knows what's in it and how AI works recognizes the risks faster — you and your team. Xylos trains your people on this with courses on AI and safe use. Read here how to prepare your organization for the AI Act.

Start small and concrete. Map out which systems and data you really want to protect. Check whether someone is continuously monitoring your environment, including nights and weekends. Make sure updates come in automatically and quickly. Establish who does what if something does go wrong, so you're not starting to think about it in the heat of the moment.

Sounds like a lot? It doesn't have to be. With managed security, Xylos takes this off your hands: monitoring, patch management and awareness, tailored to your organization. That way you keep up with attackers who deploy AI, whether or not you have your own security team.

Want to know how resilient your business is today? Start with a security assessment. We'll look together at where you stand, and tackle what matters most first.