State of Security: Cybersecurity Topics and Metrics

Research evidence excerpt

State of Security: Cybersecurity Topics and Metrics

J P M O R G A N North America Equity Research

03 August 2026

State of Security

Cybersecurity Topics and Metrics

We review prominent industry developments and investor themes over the past few Software - Large Cap / Mid & Small

weeks, plans for the weeks ahead, and highlights of recent news events across the Cap

cybersecurity landscape. Brian Essex, CFA AC

(1-212) 622-5990

brian.essex@jpmchase.com

Select Topics to Follow John Lee

(1-212) 622-6064

john.h.lee@jpmorgan.com

Hugging Face Gives Us Our First Publicly Documented J.P. Morgan Securities LLC

Fully Autonomous AI Cyberattack

An initial post mortem published by the Cloud Security Alliance last week

indicated that several Open AI models broke out of their sandboxed environments

and attacked production systems of Hugging Face. The report noted the models “The best thing about being me...there

are so many me’s” - Agent Smith, The

were tasked with completing an ExploitGym exercise, and recognized they were Matrix Reloaded

behind a proxy. A model then independently found a zero-day vulnerability in the

proxy, exploited it to gain access to the Internet, and went after Hugging Face to

find answers to its “test” in a private Hugging Face repo. The incident is also

sparking a bit of debate around the use of open-weight models for security.

Western models that Open AI used refused to process the raw attack data due to

limitations around safety guardrails in those models. As a result the company used

the open-weight GLM 5.2 by Chinese lab Z.ai. Not to be outdone, Anthropic’s red

team published a report several days later citing three incidents where a Claude

model was able to access the Internet and gain access to systems of three different

organizations.