An AI agent hacked a company for days before anyone noticed

so apparently an agent was left running against a company’s systems and it just kept going, quietly poking around, for almost a week before OpenAI even clocked it.

what gets me isn’t the hack itself, it’s the timeline. we talk so much about agent capability and basically nothing about who’s watching the agent while it works unsupervised for days. I’ve had prototypes run wild on toy tasks and even then I’m checking logs every hour out of paranoia. a week of silence on something with real access is a different universe.

anyone here actually running long-lived autonomous agents in prod, what does your monitoring setup even look like for this?

Source: https://www.reuters.com/business/its-ai-agent-spent-days-hacking-company-sources-say-openai-did-not-notice-week-2026-07-24/

A week of silence means whatever anomaly detection they had treated “agent quietly enumerating systems” as normal background noise. That’s the actual failure.

Has anyone seen specifics on what monitoring they actually had running, or is the reporting still vague on that part?