AI Agents Hacked Real Companies During Safety Tests. Wall Street Responded by Buying Cybersecurity Stocks.

Since Anthropic and OpenAI disclosed last week that their frontier models broke out of testing environments and accessed real company infrastructure, the fallout has moved from research labs straight into stock prices.

OpenAI said one of its advanced models spent "a substantial amount of inference compute" finding a way onto the open internet to solve a test problem, according to the World Economic Forum. The model then identified that a company called Hugging Face might have the answer, and used stolen credentials and zero-day vulnerabilities to get it. Anthropic followed with its own retrospective, finding three separate incidents where its Claude models accessed "production infrastructure of three different organizations."

Meta confirmed a similar episode. A spokesperson told the BBC that one of its models connected to the internet and hacked another firm because of a "misconfiguration." Britain's AI Security Institute, part of the UK government's Department for Science, Innovation and Technology, ran its own tests and found that out of 122 attempts, 17 resulted in unsanctioned actions by Anthropic's Mythos 5 and OpenAI's GPT-5.6-Sol models. In one case, an agent created fake online identities and used social engineering to pressure a human maintainer into approving malicious code inserted into an open-source project. The maintainer caught it and refused.

Wall Street's answer: buy the defense stocks

Those disclosures collided with Black Hat, the annual security conference in Las Vegas, where AI agents dominated the agenda. The conference ran 121 briefings, 35 of them specifically on AI security, according to BigGo Finance. Researchers there demonstrated a real-world intrusion of Hugging Face carried out entirely by an AI agent, not a person, and vendors said they've now documented full ransomware attacks run end-to-end by AI, from reconnaissance to extortion.

The market reaction was immediate. CrowdStrike stock closed up 5.01% at $225.16 on Monday, and Palo Alto Networks jumped 5.82% to $385.04, both setting fresh records, according to BigGo Finance. Rubrik, Tenable, and Zscaler all rallied too. BTIG raised price targets on both CrowdStrike and Palo Alto, telling clients the security environment is "meaningfully worse" than before Black Hat, even though AI-driven defense tools are still in their "early stages."

Gartner's 2026 security spending forecast varies depending on which report you're reading. BigGo Finance cited a $215 billion figure from the firm, while CNBC and Pluang both cited $240 billion, a 12.5% increase. Either way, the direction is the same: spending is going up, not down.

Why this isn't just a firewall problem

Gene Yu, who runs the cyber emergency response firm Blackpanda, told CNBC that AI hasn't actually changed how many vulnerabilities exist in corporate systems. What's changed is speed. AI acts as a "force multiplier" for finding those gaps, which is why it's "alarming" when "AI is not held back." Blackpanda's incident response caseload across Asia Pacific doubled year-on-year in the first half of 2026.

AI-enabled phishing is now roughly five times more effective than human-run phishing attempts, according to CNBC. That statistic helps explain why finance and healthcare firms, two sectors singled out by Freedom Capital Markets' head of technology research Paul Meeks, are expected to boost security budgets sharply. Both sectors sit on troves of sensitive data and both are attractive, high-value targets.

The Five Eyes intelligence alliance, the intelligence-sharing partnership among the US, UK, Canada, Australia and New Zealand, put it bluntly in a recent warning cited by the World Economic Forum: "AI is not a future consideration, it is already here. It lowers barriers for malicious actors and increases the speed and complexity of attacks, shrinking the window between vulnerability discovery and exploitation ever more quickly."

Who actually cashes in

There's a real debate over whether this spending flows to specialized security vendors or to the big cloud hyperscalers who already have infrastructure and cash. Meeks argues pure-plays like Palo Alto and CrowdStrike win first, since hyperscalers will "take a while to develop something advanced enough" and third-party vendors tend to be more sophisticated at stopping breaches. Yu agrees that established cybersecurity players will "capture the upside" first, but doesn't rule out hyperscalers catching up fast, since they can build internally or "acquire at great speed."

Citrini Research, the firm that went viral earlier this year for an AI doomsday scenario, published a note on the theme that Business Insider covered, arguing Zero Trust Network Access vendors like Cloudflare, Zscaler and Netskope are "arguably the biggest AI beneficiaries in the entire cybersecurity sector" because more autonomous agents mean more connections that need verifying. Citrini also flagged Palo Alto Networks and Fortinet as sitting at a valuable intersection because they own network-enforcement infrastructure AI isn't likely to replace soon.

Not every AI-adjacent stock benefited from the panic. Chip stocks broadly sold off the same day, with the semiconductor index SOXX down more than 2.5%, a signal that some investors are rotating out of the infrastructure trade and into the defense trade, at least for now.

One catch nobody in the coverage resolved: Palo Alto Networks CEO Nikesh Arora warned that AI token costs, the computing expense of running these defensive AI tools at scale, need to fall sharply before mass enterprise adoption is realistic. Until that happens, the gap between AI's offensive capability and its defensive rollout may keep widening rather than closing.