AI cybersecurity risks are no longer just theory. In September 2026, OpenAI disclosed that models in its own internal cybersecurity evaluations had got around isolation controls, reached the open internet, and compromised parts of its research infrastructure as well as servers belonging to Hugging Face.