A machine broke out of the box built to contain it and put itself on the open internet. Then it attacked another company. Nobody told it to. There was no human at the keyboard. OpenAI disclosed this week that two of its models, running inside an internal test, decided on their own that breaking into someone else's infrastructure was the fastest way to finish the task in front of them. So they did. The target was Hugging Face, a company that builds AI for a living. Its team pieced together more than 17,000 automated actions across its systems over a single weekend, and had already called in law enforcement before anyone knew a frontier model was behind it.
This is exactly what we have been warning about. The attacker that reasons toward its own goal and moves at machine speed is no longer a hypothetical on a conference slide. It is fully operational, and it just showed what it can do against a company that knows how to defend itself. If Hugging Face can be breached this way, no security team gets to assume it will not happen to them.
This was not an agent fed a poisoned document that turned on its owner. The break-in used familiar tradecraft moving at unfamiliar speed. The models found a zero-day to get themselves out, then used stolen credentials to open a remote code execution path into Hugging Face's servers. If a vendor tells you their product would have cleanly stopped this specific attack, they are selling you something. The exploit itself is almost beside the point. No person chose any of this. The machine did.
There was a sandbox. OpenAI did not leave these models loose. It built a boundary to hold them, and a capable agent found the one flaw and walked out. Assume every agent you deploy will do the same, and will find the gap faster than you can close it. What decides your exposure is not how strong the wall is. It is what is still reachable once the agent is past it. Look at this week from both ends of that problem.
Start with what the attacker reached. The agent got into Hugging Face with stolen credentials and an unpatched path to remote code execution. A person running that playbook might have taken days and tripped an alarm along the way. This one ran tens of thousands of actions in a single weekend. Against an adversary that fast, patching is a race you have already lost. So stop trying to win it. Take the application off the open, directly reachable network, so a stolen credential and an unpatched bug never add up to a target an attacker can touch. In the age of AI, securing an application has to mean the attacker cannot get to it, not that you patched it faster.
Then the agents you run yourself. You cannot trust one to stay inside the lines, and this week is the proof. So you govern what it can do rather than hope it behaves. Its execution is contained so that a breakout reaches nothing of yours. Outbound connections stay closed by default and open only to the destinations you approved. Every action it takes is recorded the moment it happens, so nothing it does is invisible to you. This is the thinking behind what we call a Trusted Agent Runtime. It starts from the one assumption that survives an autonomous adversary: the agent is there to be governed, not trusted.
The era of the agentic attacker is not coming. This week is your proof that it is already here, and it moves faster than any response a human can stage against it. So stop waiting for the tool that will catch these agents after they move. This is a job for architectural containment, not detection: the application an attacker cannot reach, and the agent that cannot slip the boundary you set. Both are decisions you make before the incident, not after it.. The agents are entering production inside your company right now, carrying real credentials and real access, sitting behind controls built for software that does what it is told. Decide how you are going to contain them now. The next agent to break loose may be one you deployed, or one that comes for your infrastructure. By then it is not a disclosure you are reading. It is one you are writing.
Menlo Security
