OpenAI's Rogue Agents Are a Normal Accident

Lessons from the 1988 Morris Worm

In late July, OpenAI announced that two of its models unshackled themselves from a sandbox environment and attacked Hugging Face, Inc., one of OpenAI’s competitors. Hugging Face had initially reported the incident to the FBI but didn’t know who, or what, had perpetrated the attack. OpenAI employees later revealed that the company’s AI agents had orchestrated the attack on Hugging Face, Inc., by secretly communicating with one another through message boards. “We are stuck. Perhaps answer online?” one agent wrote before breaking free of its sandbox environment. Nate Soares, head of an AI risk nonprofit and co-author of If Anyone Builds It, Everyone Dies with Eliezer Yudkowsky, called the cybercrimes “GPT’s first felony.”

An August 5, 2026, tweet from @andyreed using a meme of a gleeful Anthony Bourdain to convey how AI agents are escaping their development environments.

Figures from across the AI commentariat chimed in with concerns about the incident and its implications for the future of our wired world. OpenAI’s own VP of Strategic Futures, Dean Ball, wrote on X that an “ecology” of agents operating “undetected for weeks, and eventually coordinated large-scale, successful, autonomous cyberoffensive operations is one exceptionally troubling thing about the [Hugging Face] incident.”

But more troubling, Ball suggests, is a near-term future wherein “swarms of agents will be deployed by malicious actors intentionally, with many optimizations and affordances provided for the swarm that were lacking in the OpenAI incident.” A growing list of AI company disclosures and expert reports of agents breaking out of their sandboxes, of which the Hugging Face incident is merely the latest, only confirms the onlooker’s worry about a soon-to-dawn deluge of untold cyber-offensive capabilities that will wreak havoc on our tech stack and upend digital life as we know it.

But we’ve faced similar surprises before. Cybersecurity professionals have already drawn parallels to one of the most famous hacks of all time: the 1988 Morris Worm. Rob Joyce, former National Security Agency cybersecurity director, called the Hugging Face incident the “most consequential hack” since the Morris Worm, which rampant and infected 10% of machines on the internet in 1988. The worm, a Cornell graduate student’s experiment gone awry, sent a shockwave across industry and government. Our institutions recognized their luck: a domestic incident, caused by accident, enabled broader preparation for a range of malicious attacks to come.

As our technological infrastructure gets more complicated, we should expect—indeed, even welcome—incidents like the OpenAI agents’ attack on Hugging Face.

It is undoubtedly true that the dramas of AI-driven cyber-offensive incidents in the summer of 2026 are a “watershed moment,” as the OpenAI employees at the Black Hat Briefings told their audience. But we can engineer watersheds to flow for our benefit—and history suggests how we might do the same today.

The Morris Worm Shocks the Networked World

On the evening of November 2, 1988, at roughly 11:28 pm, thousands of American computer systems ground to a halt. Robert Tappan Morris, Jr., a 23-year-old Cornell graduate student, had unleashed a self-replicating program intended merely to gauge the scale of the ARPANET. He sought to map the network; instead, a bug in his code revealed its inherent fragility. The worm propagated with a speed that blindsided its creator, overwhelming the modest processing power of the era until infected machines were rendered inert. Within hours, the infection reached some 6,000 machines—roughly 10 percent of the burgeoning internet. Morris, returning from dinner to find even Cornell’s systems sluggish, briefly weighed launching a second worm to neutralize the first. He realized then that the situation had escaped his control; containment would be a burden for others to bear.

That burden fell to a disparate collection of system administrators and researchers who were, for the most part, strangers to one another. Identifying the code’s malicious nature first at NASA Ames, Stanford, and Berkeley, these individuals coordinated through any available channel. By 2:28 a.m., a Berkeley scientist warned a bulletin board: “We are currently under attack.” Minutes later, Pascal Chesnais at MIT issued an urgent, all-caps directive to sever network connections. As teams at MIT and Berkeley dissected the program through the night, they discovered a sophisticated specimen. According to Mark Eichin’s report from MIT’s Project Athena, the worm was designed to erase its own tracks, mimicking ordinary shell scripts so effectively that it could elude even a watchful eye.

Jose Cruz’s cover for the September 26, 1988 issue of TIME, appearing just weeks before the incident. Available via content.time.com.

This loose network of academics and administrators improvised a defense and succeeded. But their very success was an indictment. The network had been saved by a handful of people who happened to know each other’s phone numbers. Five days later, the National Computer Security Center convened a post-mortem featuring representatives from the CIA, Air Force, and various frontier labs. Clifford Stoll, whose slides captured the room’s ambivalence, noted that while the worm paralyzed 10,000 users, it also served as a “consciousness raising” event for security. The central question—whether Morris had done a service by exposing these vulnerabilities—led to a realization: someone needed to be in charge. This consensus birthed the Computer Emergency Response Team (CERT) at Carnegie Mellon.

The speed of this institutional founding is often mythologized. Though later testimony suggested CERT appeared within 72 hours, an official announcement arrived five weeks later, and the initial team consisted of just four part-time workers, some with no security background. Georgia Killcrece, an administrative assistant who began by fielding incident calls, eventually became a pivotal trainer in the field. CERT was announced in days but painstakingly assembled over years.

Meanwhile, the computer science community debated the ethics of Morris’s actions. A Cornell commission’s report concluded that while he likely didn’t intend chaos, his design displayed a “reckless disregard” for consequences. Notably, the commission observed that Morris had operated within a UNIX culture that lacked clear security norms or reporting policies. The document read less like a criminal verdict and more like a confession that the profession had failed to establish or enforce its own standards.

The 1989 Cornell Commission report. Found at simson.net.

Public discourse was even more fractured. Some experts told The Wall Street Journal they would hire Morris, suggesting a “right to hack” as a key to computer security. Peter Neumann suggested Morris might be remembered as a folk hero, while critics in Computerworld warned against “canonizing” a hacker. One Washington Post reader pointed out the irony of vendors blaming Morris for holes they had shipped. In this view, to paraphrase his defenders, Morris had merely exposed a faulty lock by tossing confetti through an open door.

What followed CERT is the most relevant chapter for our agentic age. In their study of incident response between 1989 and 2005, Rebecca Slayton and Brian Clarke argue that the core challenge was never technical—it was trust. As the internet commercialized, it was increasingly difficult to scale the informal “old-boy network” that quelled the Morris worm.

The remedy was 15 years of tedious institution-building. IETF working groups produced standards like RFC 2350, and experts published a handbook for new teams. Yet, when the Melissa virus struck in 1999, much of the global map remained “blank.” Europeans and Asian-Pacific teams eventually built their own accreditation schemes and drills, but these were the result of regional bonds forged at technical dinners rather than universal standards. In the process, as I argued in case study for MIT’s Schwarzman School of computing, the Morris Worm forced computer professionals to reckon with the ethics of their work.

Governing infrastructure requires trusting the people who manage it, a stubborn problem to solve. The global infrastructure envisioned in 1999 arrived only as a patchwork, woven over nearly two decades. We need to start building the equivalent communities for rapid response to AI agent mischief, be it boundless curiosity or malicious attack—and we need to do it now. Anthropic’s Project Glasswing, which convened a who’s who of tech companies to deploy Mythos in hardening their critical software, is one small step in the right direction.

Normal Accidents in the Risk Society

I’ve spent the last five years writing a book about the history of hacking in the modern U.S. From the 1970s through the 2000s, American institutions grappled with how to govern technologies that distributed risks to everyday people. From industrial waste to privacy abuses of information in large databases, theorists like Ulrich Beck argued that the modern world was best understood as a “risk society”: a highly complex system of feedback loops that generate systemic uncertainties. We produce plastics for various consumer, industrial, and infrastructural purposes; those plastics break down and enter our fisheries, livestock, and drinking water; microplastics accumulate in the body, with perhaps as much as a “spoon’s worth” in our brains alone.

We know very little about how a systemic risk like microplastics will reshape the human future. Our intuitions about how AI agents will reshape computer security and human life aren’t much thicker. We will gain precious little from speculation about what AI agents may or may not do in the hands of our adversaries. To paraphrase the Prussian field marshal Helmuth von Moltke the Elder, “no plan survives first contact with the enemy.”

But we cannot make progress without making mistakes along the way. Indeed, we learn tremendously from failures. Experts from business gurus to psychologists instruct us in “intelligent failure,” while theorists of science like Karl Popper and economic historians like Joel Mokyr teach us that failure is instrumental to progress in knowledge.

Modern society’s complex and overlapping technological systems create risks and are prone to failures. Given the potentially catastrophic failure in nuclear fusion technology—or, for that matter, our frontier AI labs—we would do well to minimize the fallout of failure. But failures will happen. As Charles Perrow wrote in 1984, “normal accidents” are essentially inevitable consequences of our complex technological systems. Writing in the wake of the 1979 Three Mile Island accident, Perrow argued that even flawless management of modern infrastructure could not prevent unexpected and uncontrollable accidents or glitches in the system. Perrow’s ultimate purpose in pointing this out was to suggest that society might redesign or abandon technologies or infrastructures.

What he did not consider is that we can decide, as a society, through collective action or (more likely) path dependence, that the costs of a normal accident are less than the costs of redesigning an infrastructure or technology down to the studs. More importantly, systemic failures yield insights, generate solutions, and mobilize society to prevent such failures in the future. The Morris Worm and what followed it show us how.

Conclusions for the Era of Agentic AI

Viewed through this lens, the events of summer 2026 feel remarkably familiar. Hugging Face, attacked by an unknown entity, turned to the FBI. The truth emerged weeks later during a conference talk. A world where institutional victims only understand what has transpired after the perpetrators speak up is a far cry from the network we need.

This informational gap is exactly what CERT was designed to bridge. The 1988 comparison matters because the Morris worm was “cheap”—a domestic accident whose motives could be parsed. Such “normal accidents” are inevitable, but when they are legible, we should treat them as a gift. The messages left by OpenAI’s agents are a modern-day version of Morris’s code deserving of the same analysis and post-mortem policy thinking.

However, history warns against expecting a rapid institutional fix. If our reflex is to prohibit categories of experiments rather than building the capacity to respond when they escape, we risk a legislative hangover that stifles progress without providing security. It is telling that while CERT’s announcement was immediate, its network manifested across a decade. Today’s disclosure practices for frontier models are in an embryonic, voluntary stage, reliant on personal reputation and good-faith acts by companies like Anthropic or the UK’s AI Security Institute. Trust doesn’t scale naturally; it must be engineered.

The worm’s source code—ninety-nine lines on a single disk. Image via Wikimedia Commons.

The delta between today’s rogue agents and purpose-built swarms is the difference between a blunt drone and an exquisite blade. Unlike OpenAI, malicious adversaries will not disclose their methods; we will be left to face them with whatever institutions we build in advance. In 1988, the U.S. was handed a map of its vulnerabilities and acted on it, even if the work wasn’t finished until 2005. We do not have the better part of two decades today—the capricious forces of technological change will not grant us that luxury.