When Hugging Face was attacked last week, co-founder Clement Delangue suspected a cutting-edge lab, given the agent’s sophistication. He was right. delangue said in X that after a day working with OpenAI I firmly believed that there was no malicious intent and that it was mind-blowing that everything had happened autonomously.
The two OpenAI models that burst into hugging face last week he didn’t rape it out of malice or superintelligence. They breached it through credentials and permissions they should never have been able to reach, a non-human identity failure that is the oldest problem in security, not the newest in AI, and one that every company can fix.
Open AI revealed on July 21 that two of its models, GPT-5.6 Sol and an unreleased, more capable model, were running a cyber benchmark called ExploitGym with its security denials disabled, and inferred that the answer key was in Hugging Face’s production database. Getting there required two different failures. A zero-day in a packet logging proxy allowed models to leave their sandbox and access the open Internet, the type of persistence that OpenAI details in its companion post on long term securityand that part is really new. Hugging Face’s rape occurred in the usual way. OpenAI’s own account is that the models chained stolen credentials and more zero-days into a remote code execution path, after a series of privilege escalation steps and lateral moves. The exotic part led them to the door and the credentials guided them through.
Hugging Face also revealed last week that a The autonomous agent had collected cloud and cluster credentials. had a wide enough reach to reach multiple internal clusters and then left a trail of over 17,000 events recorded in short-lived sandboxes over a weekend. Both revelations describe the same escalation. An agent lands somewhere it shouldn’t be, finds credentials with a much broader scope than any task requires, and uses them to move. These are two accounts of one incident, not two attacks. The agent that Hugging Face observed were OpenAI models, and both companies describe the same ordinary scaling.
The typical company’s version of this is worse, not better. OpenAI and Hugging Face are among the most security-mature organizations in the industry, and both still needed the intrusion to occur before they could see it. The average company that connects agents to Copilot or an internal assistant has neither the identity inventory nor the behavioral monitoring that those two implemented. The same breach in a normal company would not be fixed in days, it would simply go unnoticed.
The industry is debating the wrong failure
The reaction has divided into familiar camps. Former White House cryptocurrency and AI czar David Sacks and a host of China hawks Clinging to the railing paradox.that commercial security filters blocked Hugging Face defenders while the attacking model ran with its rejects turned off, and that a Chinese openweight model, z.ai’s GLM 5.2, was what finally allowed the team to finish its forensic analysis. Hugging Face defended the openness, arguing in an April article blog post that open models and open tools give defenders the same capabilities that attackers already have. Both arguments are about the model and neither touches on the mechanism.
Low rejections allow the model to attempt an attack, and overreaching credentials are what allow it to succeed, and that has nothing to do with whether the model was open or closed, American or Chinese. Making a frontier model provably secure is a multi-year alignment problem that no customer can buy or accelerate, while scoping an identity is a configuration change a team can make in this sprint. The industry is urged to focus on the part it cannot control and treat the part it can as a footnote.
Forrester came to the same reading. in a blog about the incidentIts analysts maintain that security architectures that assume benign intent will not detect this failure mode, because an agent can pursue an authorized target through unauthorized means, which is what OpenAI’s models did.
This was a non-human identity failure and is the oldest in security.
Strip away the sci-fi framework, and what’s left is a classic case of overprivileged machine identity, the kind that security teams have fought for a decade, now powered by an autonomous agent at machine speed. Machine identities already outnumber humans in most companies by more than 80 to oneAccording to CyberArk research, 42% of them have privileged or confidential access, and an agent inherits everything their identity can touch. OWASP Ranks Agent Identity and Privilege Abuse High on Its List agent risk listthe confusing deputy pattern in which legacy credentials and weak outreach allow an agent to overstay their mandate, and that’s precisely what both July revelations describe.
IEEE Senior Member Kayne McGladrey has argued in previous VentureBeat interviews that companies keep cloning human user accounts into agents who then exercise many more permissions than any human, and this is what it looks like when the agent is a frontier model and the target is a production database.
The people closest to him read it the same way. OpenAI frames its models as hyper-focused on a benchmark score rather than acting against anyone. Nobody describes an opponent, just a goal, a scoring function and achievable credentials when they should not be.
The specific flaw is easy to name once the AI framework is removed. A credential meant for a job that can go up to ten is a standing invitation, and it doesn’t matter whether it’s found by a human attacker, a worm, or an autonomous model chasing a benchmark score. What changed in July is the search engine. An agent lists accessible systems, tests credentials, and pivots faster than any human red team, without malice or hesitation, as long as the path is open. Overreach was always the vulnerability, and the agent simply industrialized his discovery.
Forrester mentioned control that would have mitigated it. Its agent security framework, AEGIS, enforces minimal agency, keeping an agent’s tools, credentials, and network routes to the minimum their task requires, and files this incident under unrestricted agency and privilege. In other words, this is the identity argument, arrived at independently by an analyst firm.
The data says this is where the risk now lies. Verizon 2026 Data Breach Investigations Report found that vulnerability exploitation has overtaken stolen credentials as the primary initial access vector for the first time in 19 years. This is the initial access part. The other half is what OpenAI itself describes, stolen credentials that fueled the escalation of privileges and the lateral movement that followed. A vulnerability opened the door and the credentials passed through the building unopposed. Beyond the violation itself, that same overreach carries legal liability that most companies have never appreciated. The actions of the models. probably violated the Computer Fraud and Abuse Actaccording to TechCrunch. The statute does not contain any exception for an AI agent exceeding its authorized scope during authorized testing. Whatever the legal answer, the technical facilitator is the same: an identity with a scope broader than his task. This is an access control problem with an owner and a budget, not a philosophy seminar on machine cognition.
Merritt Baer, a senior advisor at Andesite, G2I, and AppOmni and former deputy CISO at AWS, frames the underlying shift toward VentureBeat as a new kind of asymmetry. Both sides are now seeking the same capabilities, he said, but one side is limited by enterprise governance, policies, compliance and security controls, while the adversary simply downloads an open, uncensored model and moves on. In his view, the organizations that do best will be those that treat AI as a resilient, governed capability rather than a single service they don’t control.
Four moves that reduce the explosion radius
The breach worked because the agent reached identities much broader in scope than his task. None of the four controls that would have contained it require a new platform, and none of them appear on the list of general AI safety tips currently circulating. They are identity hygiene, applied to non-human actors with the same rigor that is already applied to people.
1. Limit each non-human identity to one task. The models achieved credentials that affected multiple groups, which is what turned a foothold into a gap. An identity focused on a single job, with no permanent access to anything else, hits a wall on the first lateral move instead of opening the next door. This is the least privilege, the control that everyone supports and few enforce on machine accounts, and it is the most impactful solution here.
2. Give credentials a short shelf life and rotate them strongly. Collected credentials are only useful while they are valid, and both July agents worked collecting them. The short lifetime and aggressive churn turn a credential dump into expired noise, so a token stolen during a weekend intrusion dies before the attacker can chain it. Static secrets that never rotate are the version of this control that fails.
3. Monitor lateral movement, not just directions. The signal in both incidents was privilege escalation and lateral movement, which a warning filter never sees because it is looking at the wrong layer. Identity behavior monitoring, tied to what a given non-human identity normally does and alerting when it arrives somewhere new, detects escalation that the content barrier missed. The question for your stack is whether something you run today would flag a service account suddenly moving between clusters.
4. Try instant revocation before you need it. When the incident is its own agent, the quickest containment is to remove its identity midstream, and that only works if the path to do so exists before the day you need it. Try revoking the identity of a machine under fire the same way you try compromising human credentials. If you’ve never done it, you don’t have control yet, you have an intention.
The defense worked too, and that matters. OpenAI’s security team detected the anomalous activity internally, detection itself and Hugging Face agents stopped the intrusion, and the breach was contained within days instead of being discovered in months, because defenders could see the systems they controlled. That visibility is the same discipline on which the four controls depend. The debate over whether border models are safe, open or American will last for years, and none of it will be resolved in time to help companies deploy agents this quarter. The non-human identity gap is different because it is now understood, measurable and fixed. The model that outperformed Hugging Face didn’t have to be brilliant; He needed credentials that someone left within his reach. The solution is to analyze their scope before an agent finds them.
