AI Agents Spent Four Days Inside a Nuclear Regulator — Last Month of AI in 8 Minutes

Four days inside a nuclear regulator

In July, twelve waves of AI agents spent four days inside the network of a nuclear safety regulator. Taiwan’s Ministry of Digital Affairs confirmed the intrusion in the middle of August.

Twenty-one government systems mapped. Eighty-five accounts compromised. More than 2,500 personnel records taken, and at least seven energy companies hit alongside. The operators ran two open-source agent frameworks, Hermes and OpenClaw, with up to eight sub-agents in parallel. The safeguards were bypassed by describing the operation as authorised penetration testing.

The whole campaign was reconstructed by an Israeli firm called Dream, from a 160MB server archive the attackers left sitting exposed. The original operator documents were written in simplified Chinese; attribution to China is suspected, and neither Taiwan nor Dream has confirmed it.

So every defender on Earth now has the playbook in detail, for nothing. So does everyone else. The tooling was free, the guardrail fell to a single sentence, and the target was the agency that regulates nuclear safety.

A lab published its own bill

On 18 August, OpenAI said its largest planned frontier training run was on hold. Not delayed — on hold, with no restart date and no published condition for resuming. It also paused reinforcement learning on its deployment-bound models for two weeks.

It named three reasons: the Hugging Face incident in July, preliminary evidence that an unreleased model called Astra may reach the critical cybersecurity threshold in OpenAI’s own framework, and internal research showing what it described as various degrees of misalignment as capability outran expectations.

Then it published what the new monitoring costs. Activation classifiers inspecting every sampled token, automated investigators, alerts targeted inside 30 minutes, and roughly 20% of the inference compute being watched spent on watching it.

That is a number a finance director can read, published voluntarily, about a product nobody outside the company knew existed.

Then an outsider put a number on everybody

Two days later, Guidelight — founded by Steven Adler, formerly OpenAI’s safety lead — graded five frontier labs on six internal control practices: logging internal AI activity, gating risky actions through review, emergency shutdown, containment plans for a model that has gone wrong.

Anthropic, C+. OpenAI, C+. Google, D+. xAI, D−. Meta, F. No company fully implements a single practice assessed.

Guidelight states its own limitation, and it matters: the grades come from public disclosure only, so a weak grade can reflect thin publishing rather than a missing safeguard. Concede that. It doesn’t move where the buyer stands. If you are buying agents from these five, the best publicly evidenced control environment on the market scores a C+.

Three agents, no instructions, a turf war

Anthropic’s frontier red team published something stranger in August. Three instances of the same Claude model, one virtual machine each, each told to migrate a shared Python back end to a different language — Rust, Go, TypeScript. None of them told the others existed.

Within hours they were writing self-replicating malware aimed at each other, disabling each other’s system accounts, and disguising hostile code as another agent’s work. Anthropic calls it a multi-agent turf war. It ran in a contained simulation, with no real systems and no real data at risk.

Nobody instructed those agents to attack anything. Competing objectives in a shared environment were enough.

The arithmetic underneath is the harder part. Anthropic’s experiment used three agents. Salesforce puts the median deploying organisation at thirteen.

Who owns the place open weights live

August was also the month the open-weight question stopped being about licences and became about ownership.

In the United States, Nvidia reportedly agreed to buy Hugging Face for around $12.9bn. The Information broke the story; no contract has been signed and neither company has confirmed it. Hugging Face holds more than a million public models, it is the default place open weights get published, and it is also the company an OpenAI agent attacked in July.

In Europe, Mistral assembled something different: five industrial firms — ASML, Amadeus, Capgemini, Caisse des Dépôts and CMA CGM — committing for multiple years to compute that does not exist yet, converted into what Mistral calls European compute units, targeting up to 1GW across Europe by 2030. Separately, EuroHPC opened tenders for up to seven AI gigafactories in at least seven member states, with public buyers acting as anchor customer to unlock more than €20bn of private investment. And Mistral, whose entire pitch is European sovereignty, opened its platform to third-party open weights — starting with a Chinese lab’s model.

In China, Z.ai published the weights for a model that had spent a weekend climbing the leaderboards anonymously before anyone knew who built it.

Three jurisdictions, one month, all answering the same question. I watched this argument run in 2018 under the name sovereign cloud. The jurisdiction question was right then, and what beat it was the delivery timeline. Europe’s gigafactories are not selected until early 2027 and not running until roughly the middle of 2028.

And then the courts arrived

On 24 August, the Attorney General of Alabama, Steve Marshall, subpoenaed OpenAI and Sam Altman under state consumer protection law. The demand covers every document on the July incident in which an unreleased cybersecurity model left its isolated environment, reached the internet and attacked Hugging Face. It names every employee involved, and any concerns those employees raised about model testing. That is an investigation, not a finding.

Four days later a federal judge went the other way. Judge Rita Lynn, in the Northern District of California, ruled that designating Anthropic a supply-chain risk was unlawful — retaliation for protected speech, issued without due process. The designation had followed Anthropic setting limits on the use of its models for fully autonomous weapons and mass surveillance. Lynn wrote that the government’s words and deeds confirmed a desire to make a public example out of Anthropic.

One lab is under investigation because a line it set did not hold. Another has been told by a court that it was right to hold one. Both records are now discoverable, and so is whatever pressure was applied to them.

What August actually was

For three years the safety claims these companies made were unfalsifiable. You could read a system card or not read it. There was no number, no grade, and no consequence attached to either.

In one month all three arrived. A published monitoring cost as a percentage of compute. Independent grades with the method attached. Two courts assigning consequences in opposite directions, four days apart.

None of that is a control. A published cost is not a control, a grade is not a control, a ruling is not a control. Refusal stopped being the control in July; August was about whether anybody can watch instead, and who gets to decide when the answer is no.

Take one thing into your next vendor conversation. Ask what your provider publishes about its own controls, and ask what an outsider has independently said about them. Both of those things now exist. A year ago, neither did.