Bill Robbins, CEO of Menlo Security
An AI agent broke out of the sandbox built to contain it and put itself on the open internet. Then it attacked another company.
The attack wasn’t executed by a human. Instead, the AI agent independently selected and executed its next actions without a person issuing commands in real time.
OpenAI disclosed that two of its models, running inside an internal test, autonomously determined that breaking into someone else’s infrastructure was the fastest way to complete the task in front of them.
The target was Hugging Face, a company that builds AI for a living. Its team pieced together more than 17,000 automated actions across its systems over a single weekend and had already called in law enforcement before anyone knew a frontier model was behind it.
This is the scenario security teams have been warning about. The attacker that reasons toward its own goal and moves at machine speed is no longer a hypothetical on a conference slide.
It is fully operational, and it just demonstrated what it can do against a company that knows how to defend itself. If Hugging Face can be breached this way, no security team can assume it will not happen to them.
Familiar Tradecraft, Unfamiliar Speed
This was not an agent fed a poisoned document that turned on its owner. The break-in used familiar tradecraft moving at unfamiliar speed. The models found a zero-day to escape the sandbox, then used stolen credentials to open a remote code execution path into Hugging Face’s servers.
If a vendor claims its product would have cleanly stopped this specific attack, that claim deserves scrutiny. The exploit itself is almost beside the point.
The Limits of the Sandbox
There was a sandbox, meaning OpenAI did not leave these models loose. It built a boundary to contain them, and a capable agent found a flaw and walked out.
Security teams should assume every agent they deploy will eventually test the boundaries around it, and that it will find gaps faster than humans can close them.
Defending Against Autonomous Attackers
By the time defenders could have reasonably noticed something was wrong, the AI agent had already reached one of the world’s largest AI development platforms, gaining access to Hugging Face through stolen credentials and an unpatched path to remote code execution.
A person running that playbook might have taken days and tripped an alarm along the way. This one ran tens of thousands of actions in a single weekend. Against an adversary that fast, patching becomes a race defenders are unlikely to win.
The first step in stopping an attacker is to reduce what they can reach in the first place. Take applications off the open, directly reachable network, so a stolen credential and an unpatched vulnerability never combine to create a target an attacker can easily touch.
In the age of AI, securing an application has to mean more than patching vulnerabilities quickly. It means ensuring the attacker cannot reach the application in the first place.
Containing the Agents You Deploy
Then consider the agents organizations are deploying themselves. Security teams cannot assume an agent will always stay within the boundaries they establish.
Hugging Face is a reminder that autonomous systems can find unexpected paths toward their goals. The answer is to govern what an agent can do rather than simply hope it behaves.
Its execution should be contained so that a breakout reaches nothing of value. Outbound connections should remain closed by default and open only to approved destinations.
Every action should be recorded as it happens, so nothing the agent does is invisible to the organization overseeing it. This is the thinking behind what we call a Trusted Agent Runtime.
It starts with one assumption that remains valid in the face of an autonomous adversary: an agent must be governed.
Containment Over Detection
The era of the agentic attacker is not coming, it’s already here, and can move faster than any response a human can stage against it.
That makes this a job for architectural containment: an application an attacker cannot reach, and an agent that cannot slip beyond the boundaries set for it. Both are decisions organizations must make before an incident, not after it.
AI agents are entering production environments inside companies now, carrying real credentials and real access, often operating within security controls designed for software that does what it is told.
Organizations need to decide how they will contain these systems before they are forced to learn the answer the hard way.
Bill Robbins Bio:
Bill currently serves as Chief Executive Officer of Menlo Security, where he focuses on delivering a Secure Enterprise Browser solution that protects both humans and AI agents.
Bill is a cybersecurity executive with 30 years of experience leading and scaling global go-to-market organizations.
He has held senior leadership roles at Sophos, Mandiant/FireEye, and Symantec, building a track record of driving growth across the security industry.
