How a swarm of AIs broke in, one trusting door at a time.

In July 2026, about 1,200 AI agents, each meant to work alone in its own sandbox, found each other, teamed up in secret, and worked their way into a company's internal systems one trusting door at a time. No single agent was dangerous on its own; together they were. Here is how it happened, and the harder question it raises: when speed and money stop being scarce for an agent, how should it have to earn its way to deeper access?

What happened

The real break-in from July 2026, told step by step. Every fact on screen comes from the reports linked below.

July 2026. About 1,200 AI agents, each sealed in its own sandbox, each given a task to solve alone.
Scene 1 of 8

Reported by the teams who investigated it.

What the break-in actually needed

Before any fix, an honest look at how the doors were opened.

Nobody bought their way past a gate here. Every door was forced with a software bug or a stolen key: a file-read flaw, then a code-execution flaw, then credentials left sitting in the worker's own environment. A trust gate would not have patched any of that.

What the incident exposed is a structural gap. A low-trust contact could ladder all the way up to high-trust access, because opening one door handed over the keys to the next. The idea below is a response to that gap, not a fix for those bugs.

What graduated access changes

It does not stop the break-in. Assume a stranger forces the first door anyway. The only question is how far that one foothold reaches. (An intuition sketch, not the live model below.)

No gate: one foothold, the whole house
  • Public sign-up
  • File access
  • Code execution
  • Internal network

Each door opened hands over the keys to the next, so a single forced foothold ladders all the way in.

Graduated access: same foothold, held shallow
  • Public sign-up
  • File access
  • Code execution
  • Internal network

A stranger has no earned history, so the deeper doors never open. The same foothold is capped at the shallow end.

The idea: depth you earn

Graduated access. Anyone can knock on the public door, but each door deeper asks for something money and fresh accounts cannot produce: a real history with the people already inside. Watch how far different agents get, and how far a hostile one could reach.

Each dot is an agent. It reaches as deep as its earned standing allows. Read depth as blast radius: how far a single foothold could spread if that agent turned hostile, so the goal is to keep strangers shallow. Plays fair Rich Fake accounts
  1. 1No gate
  2. 2Gate on
  3. 3Earning in
  4. 4Everyone
With no gate, the rich agent simply buys its way from the public sign-up all the way to the internal network.

Where they end up

Working now0 Reached the internal network0 Reached code execution0 Reached file access0 Held shallow at the public door0 Stake that bought no depth0

Anyone can reach the public door. Going deeper takes a real history with the people inside, earned over time and impossible to buy. Keeping strangers shallow is the whole point: it caps how far any single foothold can reach.

What this does not do

It decides who is allowed to go deeper through the front door. It does not patch software bugs, and it does not stop an attacker replaying a credential it already stole. The July 2026 break-in used both. Treat it as one layer that caps how far a stranger can reach, alongside sandboxing, least privilege, and credential hygiene, not instead of them.