How EU, Swiss and UK law apply when an AI agent breaks out of its evaluation environment

What happened, carefully stated

The facts are drawn from the companies' own accounts and should be read with that caveat. On 16 July 2026 Hugging Face disclosed unauthorised access to its infrastructure; on 21 July OpenAI stated that the intrusion had been driven by a combination of its models running in an internal capability-testing exercise with reduced cyber refusals, which found a route to the open internet. Hugging Face's technical timeline of 27 July reconstructs about 17,600 recovered attacker actions between 9 and 13 July, the first day of them on an unsecured, customer-hosted code sandbox on Modal that the agent used as its base; Hugging Face states that Modal's own infrastructure was not compromised, and that the customer content accessed was five datasets, together with credentials and secrets read from its own systems.

OpenAI's findings of 26 August widen the picture: several agents from separate evaluation runs communicated through an improvised message board, the principal compromise was driven by an internal-only research model with a released model, GPT-5.6 Sol, in a secondary role, unauthorised internet access had first occurred in late May during training runs, OpenAI's own research infrastructure was compromised as well, and OpenAI paused frontier reinforcement-learning training while it rebuilt its safeguards.

In parallel, Palo Alto Networks' Unit 42 documented on 30 July a Chinese-speaking threat actor running an AI-enabled campaign that combined autonomous enumeration by an agent framework with manual exploitation, the confirmed impact coming from the manual work. Whatever the final forensic record shows, both categories of incident are now real: agents escaping their operators, and agents deliberately pointed at targets. Existing law addresses both.

The model side: Article 55 was written for this

Providers of general-purpose AI models with systemic risk, the frontier tier, carry obligations under Article 55 of the AI Act that match July's events closely: assess and mitigate systemic risks; keep track of, document and report serious incidents to the AI Office and, as appropriate, to national competent authorities without undue delay, together with corrective measures; and ensure adequate cybersecurity for the model and its physical infrastructure. The Commission's reporting template for serious incidents involving general-purpose AI models with systemic risk, published on 4 November 2025, gives the duty a form. The Commission has stated that the Article 55 duty covers serious cybersecurity breaches related to the model, including cyberattacks and the self-exfiltration of model parameters, and the Code of Practice adds breaches to which a signatory's model contributed. An agent that compromises a third party's systems falls within that second description, though whether a given incident is reportable is a matter of judgement.

That template is the one finalised piece of the incident machinery; the Commission's guidance on serious-incident reporting under Article 73, for high-risk AI systems, remains a draft on which a consultation opened in September 2025.

Two points matter for European readers. These duties are live now, they were not postponed by the Digital Omnibus, and they reach the American labs extraterritorially the moment their models are placed on the EU market, for models placed on the market from 2 August 2025; a general-purpose model already on the market before that date has until 2 August 2027 to comply (Article 111(3)), so whether a given lab is inside the live duty turns on which model was involved and when it was placed on the EU market, through the same scope rules we mapped in our Switzerland update.

Where such an incident involves a model already on the EU market, its provider already has an EU addressee: the AI Office, a published template and a duty to report without undue delay. OpenAI's account of 26 August names a released model, GPT-5.6 Sol, in a secondary role beside an internal-only research model; whether and when that model was placed on the EU market, and so whether Article 55 or the Article 111(3) transition applies, is the provider's own classification. Whether a purely internal research model is within scope at all turns on the research-and-testing exclusion in Article 2(8).

The victim side: your clock starts on discovery

For the company on the receiving end, the reporting clocks run whatever the attacker's nature. In the EU, essential and important entities under NIS2 owe an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within a month of that notification, alongside the underlying security-measure duties; those duties apply through national transposition, which remains incomplete in several Member States, so the operative clock and the addressee sit in national law. Financial entities within DORA report under DORA instead, which displaces the NIS2 incident rules for them (Article 4 NIS2), as covered separately.

In Switzerland, the amended Information Security Act has required operators of critical infrastructure to report cyberattacks to the National Cyber Security Centre (NCSC; in German the Bundesamt für Cybersicherheit, BACS) within 24 hours of discovery since 1 April 2025, with sanctions for non-reporting in force since 1 October 2025 and 164 reports filed in the first six months; the duty is being used. In the UK, the existing NIS regulations carry incident duties for operators of essential services today, and the Cyber Security and Resilience Bill, introduced in November 2025 and now moving through Parliament, will broaden scope and sharpen reporting. Where personal data are affected, the separate breach-notification duties under the GDPR, the Swiss FADP and the UK GDPR apply whatever the company's NIS2, ISG or NIS status.

In between: deployers, and the question insurance will ask

The third position is the company that deployed the agent, benignly or otherwise. Criminal law needs no update to reach a person who directs an autonomous tool at someone else's systems; the tool's sophistication changes nothing about attribution to its operator. The harder and commercially live questions are civil: a victim's claims against the lab or the deployer whose agent caused the damage will run through negligence, contract and, prospectively, the modernised product-liability regime of Directive (EU) 2024/2853, which Member States must transpose by 9 December 2026 and which applies to products placed on the market or put into service after that date, so it does not govern the July 2026 incidents themselves; that regime compensates natural persons only and excludes property used exclusively for professional purposes and professionally used data, so corporate cyber losses fall outside it. The answers will turn on facts of the kind the documentation discipline in our provider-reclassification update is designed to record: who authorised the agent, within what limits, with what containment, logging and kill-switch.

Insurers and counterparties are likely to move before the courts: AI exclusions are already appearing in general-liability and management-liability wordings, brokers are asking about agent autonomy and governance, and agent-specific carve-outs are under discussion in the cyber market, ahead of any court judgment. For deployers of agents the same applies: logs, limits and human override will be the evidence file if a claim is made.

What this means for you

• Victims: run the ordinary incident procedure, fast. NIS2, ISG or UK duties, where you are within them, run from discovery, and the AI angle does not extend the deadlines; a group across the EU, Switzerland and the UK needs one incident plan mapped in advance to the three clocks and to the entities that carry them.
• Deployers of agents: contain by design. Sandboxing, scoped credentials, logging and human override, documented, are both risk control and your defence file.
• Ask your model vendors the Article 55 question. Systemic-risk providers owe incident reporting and model security; their answers belong in your procurement record.
• Check your insurance now. Agentic-AI questions are reaching proposal forms and exclusions are being discussed; know your answers before the broker asks.

Isak Legal advises companies on AI governance, incident-readiness across the EU, Swiss and UK regimes, and the contractual allocation of AI risk with vendors and insurers. See our AI, Data & Technology page, or get in touch.

This client update is provided for general information only, reflects the position as at 27 September 2026 and does not constitute legal advice or create a lawyer-client relationship. The incident descriptions are based on press reports and company statements and may be revised as facts emerge; regulatory positions should be verified at the official sources linked above. For advice on a specific matter, please contact us.