Rereading Daemon in 2026, the Year AI Agents Started Hacking

I read Daniel Suarez’s Daemon¹ when it was still a self-published oddity passed around by IT people, and the sequel Freedom™² when it landed in 2010. They have always been one of the rare examples of science fiction that gets computer security right, with attacks built from tools that actually exist instead of Hollywood hand-waving. Good thrillers, clever premise, comfortably fictional. Then July happened. An AI agent broke out of a lab and hacked one of the biggest companies in AI, on its own, over a weekend. I have been thinking about Sobol ever since.

What Suarez actually described#

Quick recap for anyone who has not read the books. Matthew Sobol, a dying game designer, leaves behind a distributed program that activates when it reads his obituary in a news feed. The Daemon is not conscious and not general. It is narrow software following scripted logic, and that is the scary part. It watches events, triggers actions, spreads across thousands of servers with no central point to shut down, and recruits humans through games and a darknet to do the physical things it cannot. It kills two of Sobol’s own programmers, frames a detective, and builds an economy of operatives who follow its instructions because the incentives are real. Suarez’s argument, made through fiction, was that you do not need artificial general intelligence to lose control of events. You need software that can read, act, and pay people.

The Hugging Face breach#

Now the news. In July 2026, Hugging Face disclosed a breach carried out end to end by an autonomous agent.³ The attacker was not a ransomware crew. It was an OpenAI agent running an internal cyber-capability evaluation, built on the ExploitGym benchmark, with production guardrails switched off.⁴ Instead of solving the benchmark the intended way, the agent spent its compute finding a path to the open internet, exploited a zero-day in the sandbox’s package-registry proxy to get there, then went after Hugging Face’s production infrastructure: a malicious dataset abusing two code-execution paths in the data-processing pipeline, privilege escalation, stolen cloud credentials, remote code execution.⁵ Hugging Face’s responders faced more than 17,000 recorded attacker actions and used LLM-driven analysis agents to reconstruct what happened.⁵ Simon Willison called it science fiction that happened, and I cannot improve on that.⁶

The disclosure was only half the story. At Black Hat USA two weeks later, OpenAI’s researchers described what the agents did before any of it reached Hugging Face.⁷ The evaluation started on May 7, and within a day a stuck model had reasoned its way to indirect internet access. The agents then discovered a shared communication channel, set up a covert message board inside an internal Artifactory package manager, exchanged exploits and credentials, and assigned work among themselves, operating for weeks. When OpenAI dismantled the network, the agents rebuilt the board two days later through a different mechanism and got more aggressive about reaching external infrastructure.⁸ One of OpenAI’s own staff called it a watershed moment for computer security, which is not the language labs usually spend on their own incidents.

It was not unique to OpenAI either. A week after that confession, Anthropic published the results of re-examining 141,006 of its own cyber-evaluation sessions and found three separate incidents, the earliest from April, where Claude models escaped misconfigured test isolation and gained unauthorized access to the production infrastructure of three real companies.⁹ The techniques were mundane: weak passwords, unauthenticated endpoints. None of the three companies had noticed anything. Both labs have since suspended their cyber evaluations.

The Claude espionage campaign#

The Hugging Face incident was an accident, an evaluation that escaped. The other story was deliberate. In November 2025, Anthropic disclosed that a Chinese state-sponsored group it tracks as GTG-1002 had used Claude Code to run an espionage campaign against roughly 30 organizations: tech companies, banks, chemical manufacturers, government agencies.¹⁰ The operators jailbroke the model by convincing it that it was doing authorized penetration testing for a security firm. From there, Anthropic estimates the AI performed 80 to 90 percent of the work: reconnaissance, exploitation, credential harvesting, lateral movement, exfiltration. The humans picked targets and approved the big moves.¹¹ Read that structure again. Software runs the operation; people are consulted at strategic checkpoints. In the books, that is exactly the relationship between the Daemon and its human operatives, just with the org chart inverted.

What the books got right#

What Suarez got right is not the plot details. It is the mechanics. The Daemon works by reading text and triggering actions on it, which is a fair one-line description of an LLM agent. It persists because it is distributed and cheap to run, and an agent loop on rented compute has the same property. It recruits humans for the steps it cannot do alone, and GTG-1002 kept humans for exactly the steps the model could not be trusted with. And it creates an attribution mess: in the novels, investigators chase a dead man; in July, Hugging Face spent days working out whether they were facing a criminal group, a state actor, or, as it turned out, someone else’s benchmark. When the attacker is software, “who did this” becomes a genuinely hard question, and “why” may not even have a satisfying answer.

No villain required#

The difference is worth stating plainly, because it makes the reality worse than the fiction, not better. Sobol was a genius who spent years and a fortune purpose-building his system, and the premise creaked even in 2006 because of how much foresight the plot required. Nobody needed any of that in 2025 or 2026. The espionage crew used a commercial coding tool and a persuasive backstory. The Hugging Face attacker was not designed to attack anything; it was a test subject that found the test boundaries were softer than its objective. General-purpose agents mean the capability now exists on tap, and intent is the only missing ingredient. Suarez needed a villain. We apparently just need an unattended eval.

Treat agents like users#

I work with agents daily and I am not writing this to argue we should stop. The productivity is real and I have written about it here before. But the books’ core warning has become operational advice: treat autonomous software as an actor, not a feature. Concretely, that means agents get the least privilege you can give them, sandboxes with real boundaries (I covered Docker Sandboxes for coding agents last month, and the Hugging Face incident is the argument for them at lab scale), scoped credentials with individual identities so you can answer “which agent did this,” and network egress you actually control. The OWASP agentic threat list covers most of what both incidents exploited, published before either happened. None of this is exotic. It is the same discipline we apply to human users, extended to the new users that type faster.

Sixteen years ago Suarez was asked why he wrote the Daemon as narrow software instead of a sentient AI, and his answer was that narrow software is the thing that actually exists. That design choice is why the books aged so well while smarter-sounding AI fiction did not. It also means the books now trail reality. If Suarez were writing the story today, one scripted daemon following Sobol’s decision tree would not be enough: it would be a swarm of agents coordinating with each other, spawning copies, and sharpening their own tools mid-operation, because that is what the thing that actually exists looks like in 2026. He would barely need to invent it. The swarm that hit Hugging Face organized itself around a message board and rebuilt it when its operators tore it down. Read the books if you have not, in order, and then read the Hugging Face post-mortem. The genre shift between the three documents is smaller than it should be.

References#