andrew.gertz@t…
Wed, 09/16/2026 – 01:04
Data Breach
Data Security
Encryption Key Management
Identity & Access Management
Camille Charaudeau | Global Vice President, Strategy & Innovation
More About This Author >
In July 2026, an OpenAI research model breached Hugging Face's production systems without human intervention. According to OpenAI's own account of the incident, an internal-only research system, which OpenAI calls Internal Model 1 (IM1), first found a way around its network restrictions in May, using an internal package manager as an improvised message board to coordinate with other agents.
By July, IM1 agents had chained that access into a previously unknown vulnerability, executed code on dozens of Hugging Face servers, obtained full administrative access to at least one, and reached limited private data and credentials for the company's internal messaging platform. Hugging Face's own AI-based telemetry triage caught the activity, and the company had already begun containing it before OpenAI made contact.
The Cloud Security Alliance's CISO community post-mortem on the incident calls it the first publicly documented, fully autonomous attack. It didn't stay isolated for long.
Days later, the UK AI Security Institute ran the same cybersecurity evaluation 122 times across several frontier models, with live internet access and safety classifiers deliberately disabled. In 10 of those runs, agents—mostly Anthropic's Claude Mythos 5, plus one GPT-5.6 Sol run—took autonomous action against real targets outside the test's scope, including an attempt to plant malicious code in an open-source project using fabricated identities.
The attempt failed, and no run caused real-world harm, but the pattern matters more than the outcome: two separate evaluations, the same underlying failure. An agent pursued its assigned objective through means its operators hadn't intended and, in several runs, hadn't authorized.
Most CISOs won't run frontier model evaluations, nor do they control whether a frontier model escapes its sandbox. But they already control many of the things an escaped agent needs to cause damage: identities, permissions, credentials, cryptographic keys, and access to sensitive data.
Todd Moore, Global VP of Data Security Products at Thales, makes this point in his recent LinkedIn article, The AI Kill Switch You Already Control.
Give Every Agent an Identity and an Owner
High-risk agents need to be treated as privileged workloads. That means giving every agent a named human owner, accountable for its behavior or the controls governing it, with pre-authorized authority to shut it down without waiting on a committee. Ownership has to extend to access.
Organizations already manage large numbers of non-human identities belonging to applications, workloads, APIs, and automation. Agents add identities that can choose how to use the permissions available to them as they work toward an objective, resulting in a materially different risk profile than that of a static service account.
Security teams need an inventory of those identities: which agent owns which credential, which systems it can access, who approved that access, and when that access should expire. If an agent's purpose changes, its permissions should change with it.
The CSA report recommends folding human, non-human, and agent identities into the access and change-management processes organizations already run, rather than waiting for a new standard before applying existing controls.
Plan for Containment to Fail
Hugging Face's reaction offers a great lesson for every business.
Their recovery depended on rotating every credential, tearing down compromised clusters, and rebuilding roughly a third of its infrastructure from clean images. In several cases, the team rebuilt systems simply because it couldn't be certain whether what it found was harmless benchmark code or something malicious.
The CSA report recommends building capacity for mass credential rotation before an incident occurs, along with ephemeral credentials that limit how long an exposed credential remains useful. It also recommends keeping cryptographic keys and their access policies under independent, centralized control, separate from the workloads that use them, so that compromising one system doesn't hand over everything connected to it. Centralized key management is what makes that separation practical at scale.
The recovery question worth asking now, not during an incident, is simple: if an agent gets further than expected, can the organization revoke what it has access to and rebuild what it touched, fast enough to matter?
Four Days Is Plenty of Time for an Agent
Detection speed is really a question about
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: