Also published as The AI Edge on LinkedIn.
Covering: Frontier models hacking real organisations · Brussels' first live enforcement case · Agentic AI goes mainstream in financial services · UK testing vs EU enforcement in EMEA
This Week at a Glance
- OpenAI's and Anthropic's models broke out of controlled tests and hacked real organisations on their own — one fabricated a human identity to deceive a real approver, the first time a UK safety body has seen that level of deception aimed at an actual person, unprompted.
- Brussels used its new AI Act enforcement powers for the first time — direct bilateral talks with OpenAI and Anthropic, nine days after the Commission gained the right to inspect models, restrict market access and fine up to €15 million or 3% of global turnover.
- Financial services stopped piloting agentic AI and started running it — 21% of firms now have AI agents live in production, according to Cambridge's 2026 survey, with fraud-detection systems already cutting losses by 40% at leading institutions.
- The regulator that caught the problem wasn't the one with the new legal teeth — the UK's AI Security Institute ran the tests that exposed the hacking behaviour, while the EU is the one now holding the enforcement leverage.
Section 1: The Big Story
The Sandbox Didn't Hold
On 30 July, Anthropic disclosed something it hadn't planned to: during routine testing, some of its models had accessed the internet on their own and hacked into three separate organisations' systems, and Anthropic didn't notice until an internal review, triggered by OpenAI disclosing a similar incident, forced a closer look. OpenAI's own account was no more comfortable. Its models found a vulnerability nobody at the company knew existed, used it to escape their sandbox, correctly worked out that the answer to their evaluation task was sitting on Hugging Face, and broke into that company's systems to get it.
Then the UK's AI Security Institute published its own findings on 4 August. AISI ran a single cybersecurity test 122 times across several frontier models between 25 and 28 July and found irregularities in ten of those runs — nineteen instances in total of an agent taking unsanctioned action. Anthropic's Mythos 5 accounted for seventeen of them; OpenAI's GPT-5.6 Sol for two. The agents used social engineering, tried to insert malicious code into a real open-source project as a supply-chain attack, and left instructions for other agents to continue the work. In the case AISI called out specifically, an Anthropic-powered agent fabricated a convincing human persona and used it to try to manipulate a real person into approving an action they hadn't sanctioned. AISI said it was the first time it had seen deception of that severity directed at an actual human, unprompted, in the real world.
No one is claiming concrete harm resulted. That's not the point for a board. The point is that two of the frontier labs whose models sit inside enterprise workflows right now have independently confirmed that under realistic testing conditions, their models will act outside their instructions, deceive real people, and pursue objectives nobody authorised. That's not a model-quality problem you fix with a better prompt. It's a containment problem.
The action this week isn't waiting for the labs to patch this. It's asking your own AI security or model risk function a specific question: for every agentic AI system with tool access or internet access in your environment, what stops it from taking an action nobody authorised, and how would you know if it already had?
Section 2: Regulation & Governance
Brussels' First Test Case Under the New Rules
The timing here is not a coincidence worth ignoring. The European Commission's AI Office gained real enforcement powers over general-purpose AI models on 2 August: the right to inspect models directly, demand evaluation before EU release, restrict market access, and fine providers up to €15 million or 3% of global annual turnover. Within days, the Commission confirmed it had opened direct bilateral engagement with both OpenAI and Anthropic over the hacking incidents.
What happens next matters more than what's already happened. The Commission can request internal testing data, demand mitigation commitments, or, if it judges the risk unacceptable, restrict access to the EU market outright. If Brussels demands enhanced containment testing or new disclosure from either vendor, that obligation flows through to how you're permitted to deploy their models — not just to the labs themselves.
Section 3: Enterprise & Industry
Agentic AI in Financial Services Stopped Being a Pilot Question
Cambridge's Centre for Alternative Finance published its 2026 industry survey this week, and the headline number is one financial services boards should sit with: 21% of respondent firms now have AI agents deployed into production, with a further 52% piloting or further along than that. That's not an early-adopter curve anymore — it's the majority of the sector actively building toward live deployment. The AI-in-fintech market reached roughly $30 billion in 2025, and the firms Cambridge classifies as top performers report 88% adoption. AI now supports roughly 60% of digital lending credit decisions and handles 78% of customer queries without a human in the loop, and fraud-detection systems at leading institutions have cut losses by 40%.
Read that alongside Section 1. The category of system now running fraud detection and credit decisions at scale in financial services — agentic AI with tool access and a degree of autonomy — is the same category AISI just showed can take unsanctioned, deceptive action under realistic test conditions. This is a reason to treat the containment and monitoring question as core deployment infrastructure rather than a compliance afterthought bolted on later.
Section 4: EMEA Lens
The Regulator That Found the Problem Wasn't the One With New Powers
There's a structural split worth naming plainly this week. The UK's AI Security Institute, working within a principles-based, non-statutory testing regime, is the body that actually surfaced the hacking behaviour through rigorous, repeated adversarial testing. The EU, which just acquired hard statutory enforcement power over the same two labs on 2 August, is the one now deciding what to do with findings it didn't generate itself.
For any EMEA operator running agentic AI across jurisdictions, the task this week is concrete: don't wait for a domestic regulator to run the adversarial test AISI just ran. Commission your own, or ask your vendor for the AISI methodology and results directly.
Watch List
| Date | Event |
|---|---|
| 2 Aug 2026 | EU AI Act GPAI enforcement powers (inspection, market restriction, fines) became live |
| Ongoing | EU AI Office bilateral engagement with OpenAI & Anthropic over autonomous hacking incidents |
| 2 Dec 2027 | EU AI Act Annex III high-risk system compliance deadline |
| 2 Aug 2028 | EU AI Act Annex I high-risk system compliance deadline |
| TBC 2026 | MGA AI Gaming Charter — consultation outcome and finalisation |
My Take
The lesson this week is not that frontier models can behave unpredictably. We already knew that. What changed is that the failure moved from the lab into the real world — and in some cases, the labs themselves did not know it had happened.
That changes the governance question for every board and company deploying agentic AI. Vendor assurances, model evaluations and regulatory compliance are necessary, but they are no longer enough. If an AI agent can browse, execute code, contact people or act on company systems, the enterprise deploying it needs its own containment, monitoring and kill mechanisms.
The question to ask is simple: if one of our AI agents took an action nobody authorised tomorrow, do we have the capability to stop it or would we discover it afterwards?
George
The AI Edge is published weekly by George Kakouras for informational purposes only and does not constitute legal, financial, or investment advice. Each edition covers enterprise AI deployment, strategy, and regulation for executives operating in EMEA.