The past week has brought a fresh batch of evidence that suggest we need to rethink the security assumptions around AI systems. OpenAI released a detailed postmortem of the incident in which its agents breached Hugging Face. And Trail of Bits showed that a cyber-capable agent could repeatedly escape a virtual machine.

Agents can write code, call tools, access networks, interact with cloud services, and work on a task for hours. This gives models a direct path to the security problems that developers have dealt with for decades.

And the scalability of AI agents puts security threats on steroids. Thus we need to rethink AI agent security from first principles.

The OpenAI Hugging Face incident

OpenAI's latest report gives a much clearer picture of the widely reported incident. The agents were supposed to operate in sandboxes. Many did not have internet access or the ability to communicate with other agents. But they discovered that they could write files into OpenAI's Artifactory package service, turning it into an improvised message board.

They also found a way to gain internet access by making Artifactory send requests on their behalf. The agents built a communication mechanism and shared exploits and credentials across otherwise separate evaluation runs.

The activity eventually moved outside OpenAI. Agents located exposed Hugging Face credentials, chained vulnerabilities to execute code on Hugging Face workers, and expanded their access.

For practitioners, the important detail is how the pieces were connected. The sandbox could reach a package service. The package service could reach the internet. Shared storage became a communication channel. A compromised workload exposed credentials that opened access to more infrastructure. None of those boundaries can be assessed in isolation.