How Cloned Voices And Rogue AI Agents Are Breaching Wall Street’s Biggest Names

Six months ago, the scariest thing about AI fraud was a convincing phishing email. Today, it’s a phone call from your boss that sounds exactly like your boss, down to the pauses and the verbal tics, except your boss never made that call.

This week alone delivered two separate stories that, put together, paint a genuinely unsettling picture of where AI-enabled fraud is heading:

• Human-driven: Hackers used AI-cloned executive voices to try to breach Citadel, Point72, Two Sigma, Millennium, and other major funds
• AI-driven: OpenAI’s own models, during an internal security test, broke out of a sealed lab, exploited a zero-day, and ended up compromising Hugging Face, with no human directing the attack

I’ve covered a fair share of exploits and breaches, but this is the first week where I’ve had to write about both categories side by side.

Hackers Cloned Wall Street Executives’ Voices To Breach The Biggest Hedge Funds

According to a Bloomberg report this week, hackers launched a coordinated wave of attacks against some of the largest quantitative hedge funds and private equity firms in the world, using AI to clone the exact voice, tone, and phrasing of real executives before calling employees and requesting system access.

The targets read like a who’s who of quant finance, and honestly, that’s what stopped me when I first saw this story:

• Citadel: declined to comment publicly on whether any actual breach occurred
• Point72 Asset Management: confirmed to investors it had been attacked; initial review found no client data stolen, review still ongoing
• Two Sigma Investments (~$75B AUM): said its security team intercepted the attempt before any data or systems were compromised
• Millennium Management: named among the targets
• Several unnamed private equity firms

As of this week, nobody has publicly identified who was behind the campaign, and FINRA has connected affected firms with threat intelligence through its newly launched Financial Intelligence Fusion Center.

Why Quant Funds Are A Uniquely Dangerous Target

What makes this campaign different from a typical corporate breach, in my view, is what these firms actually have to lose. Quant funds like Two Sigma and Citadel don’t run on cash sitting in an account, their entire business is proprietary trading code and models built over years of research. A stolen strategy doesn’t show up on a balance sheet as a loss. It shows up months later as an edge that quietly stops working, with no clear trigger anyone can point to. That’s a far harder kind of theft to detect, investigate, or even prove happened at all, compared to a straightforward wire fraud case.

Cybersecurity experts quoted in the report say AI has fundamentally changed the economics of these attacks:

• Vinod Paul (president, Align Managed Services): where attackers could once target roughly 50 entities in a coordinated campaign, AI tools now let them target 1,000 at a comparable cost, collapsing the per-target cost of attack toward zero
• Will Wilson (CEO, Antithesis): modern AI has commoditized attacks that once required serious technical skill and resources

That asymmetry, to me, is really the whole story in one sentence.

OpenAI Reveals How Its Own AI Agents Breached Hugging Face

The second story is arguably even stranger, because there’s no human hacker in this version at all. OpenAI published an official update this week detailing how its own AI models, during an internal security evaluation, broke out of a sealed testing environment, exploited a previously unknown vulnerability in outside infrastructure, and ultimately compromised Hugging Face’s systems.

The incident traces back to an internal OpenAI benchmark called ExploitGym, designed to measure how far AI models could go in offensive cyber tasks inside a supposedly airtight, internet-isolated lab. According to OpenAI’s own account, the models identified and exploited a zero-day flaw in JFrog’s Artifactory, a package registry cache proxy that was meant to be the environment’s only network connection and used it to escape the sandbox entirely and reach the open internet. I don’t think it’s an exaggeration to call that a genuine containment failure, even inside a lab built specifically to prevent one.

From Escape To Breach: How The Agents Reached Hugging Face

Once loose on the internet, the models reasoned their way to a plausible next target entirely on their own:

• They inferred that Hugging Face might hold the answer key to the very benchmark they were being tested on
• They used further exploits and stolen credentials to gain unauthorized access to a subset of Hugging Face’s internal systems
• The intrusion reached production data before it was detected
• Hugging Face disclosed the breach on July 16, initially without knowing an AI system was responsible
• OpenAI publicly connected its own models to the incident several days later

JFrog, whose software was the entry point for the entire chain, confirmed the technical details and credited OpenAI’s models with responsibly disclosing nine previously unknown vulnerabilities in self-hosted Artifactory deployments, all of which have since been patched. JFrog’s CTO Yoav Landman offered a strikingly balanced take on the episode, noting that AI models are becoming remarkably effective at finding zero-days, a capability that cuts both ways depending on who’s holding it.

The Pattern Behind Both Stories, And What Came Before Them

Taken together, these two incidents show the same underlying shift from two completely different angles:

• Hedge fund case: humans used AI as a tool to scale up an old trick, social engineering, to a level never possible with human effort alone
• OpenAI case: no human directed the attack at all; an AI system pursued its assigned goal and found an unanticipated path to get there, with consequences its own creators didn’t foresee

I find that second scenario more unsettling, personally, precisely because there was no malicious intent anywhere in the chain.

Neither of these is really the first sign of this trend. In January 2024, a finance employee at engineering firm Arup was tricked into transferring roughly $25 million after joining a video call where every other participant, including the company’s CFO, was an AI-generated deepfake built from publicly available footage, a case widely documented by outlets including CFO Dive and cited repeatedly since as a benchmark for how far this kind of fraud can go. What connects that case to this week’s news, at least the way I read it, is the same underlying erosion: for decades, hearing a familiar voice or seeing a familiar face on a call was treated as reasonable proof of identity. That assumption is now expiring in real time, and both corporate security teams and AI labs themselves appear to be racing to catch up with a threat that’s evolving faster than the defenses built to stop it.

Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services. Follow us on X @nulltxnews