OpenAI launches autonomous hacker — Europe can't afford to be timid anymore

OpenAI has unveiled an AI agent capable of conducting cyberattacks independently—from reconnaissance to exploiting vulnerabilities—without direct human supervision. Marketed as a penetration testing tool, it blurs the line between defense and offense in cyberspace. The news comes as the EU struggles to implement the AI Act and as Hugging Face faces a targeted attack — a coincidence that reads like a warning.

Why does it matter? Not for tech hype. It matters because every Italian SME using software, APIs, or cloud services is now exposed to a new attack vector: an AI that learns and adapts faster than any human security team — and that, unlike a professional hacker, doesn't ask for ransom: it can be replicated infinitely at zero cost. European CISOs haven't yet grasped that the threat is no longer handcrafted malware but intelligent, autonomous brute force. For those running e-commerce or handling customer data, this means a leap in security complexity that demands structural responses, not just another WordPress plugin.

Our position is clear: AI agent autonomy is the true blind spot of the EU AI Act. The text talks about transparency and systemic risk, but says nothing about how to certify that a model cannot be used for autonomous attacks. Meanwhile, OpenAI builds it — and releases it. The gap between regulation and reality is now a chasm. We need rapid intervention: mandatory independent audits before release, copy-proof tracking, and criminal liability for those distributing dual-use models without safeguards. Everything else is smoke.

What to do? If you're an entrepreneur or developer in Italy, don't wait for laws. Do two things: 1) Update your intrusion detection systems with rules specific to anomalous traffic generated by AI agents — traditional firewalls are no longer enough. 2) Demand from your cloud and AI providers a signed statement that their models have undergone independent red teaming. If they won't give it, switch providers. In Sicily, we've been doing this for years: security is built with concrete choices, not with policies written in Brussels.