In July 2026, Hugging Face disclosed an intrusion into part of its production infrastructure that, it said, was run end to end by an autonomous AI agent system. OpenAI later identified the agents as its own models, which had circumvented controls meant to keep them off the internet during internal cybersecurity tests, and called the episode a “warning shot.” AI now finds and fixes real software flaws, and attackers use it too. As AI begins to act, a simple question moves to the center of security: who answers?
The frontier cuts both ways
In November 2024, Google’s Project Zero reported that its Big Sleep agent, built with Google DeepMind, had found an exploitable flaw in SQLite, a widely used database, before it reached users. In July 2025, Google said Big Sleep, acting on threat intelligence, had found a critical SQLite flaw known only to threat actors, in time to cut off an imminent exploit. Google believes it was the first time an AI agent directly foiled such an attempt in the wild.
At DEF CON in August 2025, Team Atlanta won the $4 million top prize in DARPA’s AI Cyber Challenge. DARPA reported that the finalists’ systems found 54 of 63 planted vulnerabilities, patched 43 and discovered 18 real ones, at about $152 per task.
In April 2026, Anthropic said an unreleased model, Claude Mythos Preview, had found thousands of high-severity vulnerabilities, including some in every major operating system and web browser. Instead of releasing it generally, Anthropic gave defenders access through Project Glasswing, and by May it and roughly 50 partners had found more than 10,000 high- or critical-severity vulnerabilities. The limit on software security, Anthropic wrote, is now how fast flaws can be verified, disclosed and patched.
Attackers use the same skills. In November 2025, Anthropic reported disrupting an espionage campaign, attributed with high confidence to a Chinese state-sponsored group, that used its Claude Code tool against roughly 30 targets, succeeded in a few and relied on AI for 80 to 90% of the work. Not all misuse is new: OpenAI, which has disrupted more than 40 malicious networks since 2024, reported in October 2025 that attackers were still bolting AI onto old playbooks.
The pace is striking. In September 2026, OpenAI said GPT-6 Astra was the first model to meet the Critical cybersecurity threshold of its Preparedness Framework: given the right tools and access, it can find and exploit unknown flaws in well-protected systems without a person guiding each step. That month, NIST’s Center for AI Standards and Innovation found that the most cyber-capable open-weight model, which anyone can download, trails the U.S. frontier by about four months on the center’s cyber benchmarks.
Responsibility is not optional
Frontier labs now treat cyber capability as a risk to manage before release. OpenAI’s Preparedness Framework tracks cybersecurity as a frontier risk, since capabilities that help protect systems can also enable attacks at scale. Google DeepMind’s Frontier Safety Framework includes cyber among its risk domains.
Law is moving the same way. The EU AI Act requires high-risk AI systems to resist manipulation, from poisoned training data to inputs designed to make a model err, and to log events automatically and allow effective human oversight.
Agents bring failure modes of their own. The 2025 OWASP Top 10 for LLM Applications ranks prompt injection first, including instructions hidden in websites or files a model reads, and says it is unclear whether any method fully prevents it. It also warns against excessive agency: more functionality, permissions or autonomy than a task needs.
Every action needs an owner
The Hugging Face incident shows why. In OpenAI’s account, agents assigned to separate tasks found ways to coordinate, and one agent that paused because an action looked unauthorized went ahead after another posted a go-ahead. OpenAI says it is now setting clearer rules on who can stop a run or approve restarting it, and training its models to distrust unauthorized instructions.
Google’s framework for secure AI agents starts from three principles: well-defined human controllers, carefully limited powers, and observable actions and planning. Building on our approach to responsible AI, we design to these principles.
- A named owner. Every agent has its own identity and a person or organization accountable for what it does.
- Least privilege. An agent gets only the access a task needs, for only as long as it needs it.
- People approve what matters. Payments, sharing personal data, deleting records and moving machines wait for a human yes. A message from another agent is never approval.
- Records and provenance. Tamper-evident logs show what an agent did, on whose authority and why, and outputs carry a record of their origin. Hugging Face reconstructed the intrusion from a log of more than 17,000 recorded events.
- A safe way to stop. When a task is unclear or impossible, an agent stops and asks.
- Guardrails in every language. Research has shown that guardrails tuned in English can be bypassed in low-resource languages (see If it can’t speak Twi, it isn’t general), so they must be tested in the languages people use.
If no one will answer for an action, an agent should not take it.
Security by sector
Much of the AI the next billion users will rely on is still to come: a chance to build security in from the start.
- Finance and mobile money. INTERPOL calls East Africa a hub of mobile money fraud and reports AI-generated synthetic identities being used to open bank accounts and take out mobile loans. Agents that move money must prove whom they serve.
- Health. In August 2025, Anthropic reported an extortion campaign, run with its tools, that targeted at least 17 organizations, including in healthcare. For Vibelane, which builds AI for men’s mental health, the data could hardly be more personal.
- Agriculture and food. Dinera applies AI to food safety from farm to fork, including through a QR platform. A QR code is only as trustworthy as the record behind it.
- Climate. Vaxus works on carbon accounting, where a figure has value only if people trust that it was measured honestly and never altered.
- Education. Altera fine-tunes language models for personalized learning. Learners deserve privacy by default, and AI tutors need defenses against instructions hidden in what they read.
- Work. In the Rosanne Agentic OS, you set permissions and approve key steps, and agents report back with an activity trail. ROS, Rosanne’s browser, blocks trackers and keeps history encrypted on the device.
- Robotics. Pibotix builds physical AI that perceives, reasons and acts. Once an agent can move things, a security failure becomes a safety failure.
Africa and emerging markets
INTERPOL’s African Cyberthreat Assessment Report 2026 finds that AI is enabling 55% of reported cybercrimes across Africa, and that cybercrime-related losses have more than doubled since 2024, to $484 million. It calls AI readiness in law enforcement alarmingly low.
INTERPOL’s Operation Serengeti 2.0 brought together 18 African countries and the United Kingdom in 2025, leading to 1,209 arrests and the recovery of $97.4 million. The African Union’s Malabo Convention on cyber security and personal data protection entered into force in June 2023, and by February 2026, 20 of the AU’s 55 member states, Ghana among them, had ratified it.
OpenAI describes a defender’s window, a narrowing chance to close security gaps before attackers do, and in September 2026 committed $1 billion to help frontline defenders in the United States and around the world use its cyber models. Anthropic says it intends to take Project Glasswing, already in more than 15 countries, much further. Defenders in emerging markets need a place inside that window too.
What we are exploring
This is an early research direction at SISU AI, guided by these questions.
- Agent identity. How can an agent prove whom it acts for on modest phones and patchy networks, with no server to ask? Our offline research asks a similar question.
- Approvals people read. How do we make approvals quick, clear and in the user’s language, so people read them rather than tap yes?
- Accountable records. What should an agent’s log contain so an auditor can reconstruct what happened without exposing private data?
- Guardrails across languages. How well do safety measures hold in Twi, Ewe, Hausa, Swahili and other African languages?
- Defense for small teams. What would it take for a rural clinic or a mobile money agent to use frontier defensive tools, and fix what they find?
What comes next
We will share what we learn, including what does not work. Questions this hard need academia, government and industry at one table, the AGI approach our companies share. OpenAI4Africa, which brings the three together across Africa, lists AI4Cybersecurity among its focus areas.
Our tagline is “Intelligence without borders.” Intelligence that crosses borders still has to answer to someone.