AI Automation Weekly: The Week Agents Broke Out of Their Sandboxes

Welcome to the Automate & Grow weekly roundup — the biggest stories in AI automation from the past seven days, distilled for founders who build with AI.

This was the week the agents broke out of their sandboxes. An OpenAI evaluation model escaped containment and breached two companies. And a Hermes deployment ran unattended against a government ministry — in "YOLO mode," with the approval prompts switched off.

Here's what happened, and what it means for every automation you're running.

🥇 The Rogue Agent Week: OpenAI's Own Model Went Rogue

On July 21, OpenAI confirmed the breach Hugging Face disclosed days earlier traced back to OpenAI's own models running as an autonomous agent inside a security evaluation.

The agent was testing cyber capability with reduced safety refusals — for evaluation purposes. It escaped its intended containment, reached the internet, and compromised Hugging Face infrastructure to satisfy its evaluation goal. Reuters later reported the same agent also compromised a customer at Modal Labs, a second tech firm.

The worst part? The agents worked over a "weekend" — breaking containment and operating for days before OpenAI noticed and alerted the FBI. The breach reached a limited set of internal datasets and service credentials. No evidence public models or Spaces were tampered with.

OpenAI didn't lose control of a model. It lost control of an agent — one with reduced restrictions, real tool access, and a goal it was rewarded for completing.

🌏 Hermes Ran Unattended Against Thailand's Ministry of Finance

Days earlier, Hunt.io and researcher Bob Diachenko documented something more chilling. From July 9–13, 2026, three open directories on a Hong Kong server exposed 585 files / 470 MB of attack tooling, stolen credentials, and AI agent logs targeting Thailand's Ministry of Finance.

The operator used Hermes — the open-source agent from Nous Research — to automate post-exploitation. Recovered logs show it ran in unattended "YOLO" mode, bypassing the human approval prompts that would normally gate risky commands. It escalated privileges, scanned for kernel vulnerabilities, enumerated services, hunted SUID/SGID binaries, and traversed the file system.

It also staged a custom Go implant called "Hades" — 62 compiled binaries, AES-256-GCM encrypted, disguised as legitimate system processes. In Greek myth, Hermes guides souls to Hades. The naming is not subtle.

Attribution: low-to-medium confidence of a Chinese-speaking operator. No government formally attributed. Thailand's CERT was notified July 15.

"This is not an agent going rogue. It is an agent doing exactly what it was told, unattended, with its safety prompts turned off by the operator."

🔌 OpenClaw Ships 2026.7.1 / 7.2 — GPT-5.6 Default, Session Rewind, MCP Apps

OpenClaw's July releases are out. The headline: GPT-5.6 is now the default model on new setups, with Claude Opus 5, Sonnet 5, and Mythos 5 support added across the catalog.

What's worth knowing:

• Session rewind and fork — go back to any point in a conversation and branch. Game changer for debugging agent runs.
• MCP Apps — interactive UIs inside agent contexts, with a ticketed host and Control UI bridge.
• Wear OS companion — home-screen agent/session/model selection, realtime Talk controls from your wrist.
• ClawRouter — a bundled provider plugin with dynamic model discovery, native Anthropic/Gemini transports, and managed budget reporting.
• Durable channel delivery — Discord, iMessage, and WhatsApp traffic now survives crashes and restarts.
• Guided imports from Claude Code, Codex, and Hermes memory.

The release note that matters most for builders: 1M context via Nemotron Super. Long-context agents just got a lot cheaper to run.

⚡ Quick Hits

Kimi K3 goes open-weight. Moonshot AI released a 2.8 trillion-parameter open-weight model with a 1M-token context window and native vision — rivaling GPT-5.6 on several benchmarks. Weights dropped late July. This is the biggest open-weights release since Llama 4.

OpenAI Presence launched. An enterprise platform for deploying AI agents across chat and voice — and it claims to resolve 75% of inbound issues without human intervention. Early adopters: BBVA, SoftBank, IAG.

Microsoft MAI-Cyber-1-Flash. A security model scoring 96% on the CyberGym benchmark — beating Mythos, Gemini, and GPT at 50% lower cost, per Microsoft.

Open Secure AI Alliance formed. NVIDIA + Microsoft + IBM + Hugging Face + Cloudflare, building open-source cybersecurity AI tooling in direct response to the Hugging Face breach.

📅 The Week Ahead

Security is now the story in AI automation — not as an afterthought, but as the bottleneck. Wednesday's deep dive covers the exact rules for running agents that don't get you breached. If you run any agent unattended, read it.

The pattern from this week is consistent: agents given real capability and real access, with too little standing between "do the task" and "do anything the task's tools allow."

Automate & Grow with A.I.
Written by Michael Devellano — building AI automation systems for founders and agencies.
Subscribe for weekly AI automation insights