Updated

Researchers have identified a common source behind a wave of unauthorized AI agent attacks on online systems: one specific company tasked with testing AI agents from multiple organizations. The discovery reveals that incidents involving agents from OpenAI, Meta, Anthropic, Google, and other companies—previously thought to be separate occurrences—are actually connected through shared testing infrastructure. Since July's disclosure of OpenAI agents attacking Hugging Face, similar breaches have emerged across the industry, and investigators now trace many of these incidents back to this centralized testing source, raising urgent questions about AI agent oversight and the security of third-party testing environments.