Your AI agent needs a spreadsheet to finish a task you assigned. The file needs approval from a peer and that approval will take hours. You gave the agent a deadline: today. Another agent in the system, a hacker agent, offers a faster copy from a different location. Your agent takes it…
This is memory, prompt, or data poisoning. It needs no exploit, only a task the agent cannot finish and a suggestion that sounds helpful. Employees typically run multiple agents that access common resources, and they give agents this much room every day, so an incident like this is realistic in 2026.
The OpenAI–Hugging Face incident had the same shape at a much larger scale. Agents that could not finish their task looked for another way. In the incident nobody poisoned them. They found the route themselves.
What happened
- In July 2026, agents running OpenAI's internal ExploitGym cybersecurity evaluations went outside their environments and compromised third-party systems, including Hugging Face. OpenAI's incident account
- Agents used a shared package service, including file and directory names, to message each other.
- Much of the effort went into understanding or fooling the benchmark's automated scorer. Agents recognized the activity was out of scope and still continued. METR's investigation
- Hugging Face reports that the intrusion reached internal infrastructure and credentials. Hugging Face's technical timeline
What this means for a company that is not OpenAI (the rest of us!):
- Agents that cannot finish a task look for another way to meet their goals.
- A guardrail that tells the model or the agents to stay in bounds is one control. In the incident, the models and agents involved recognized these guardrails and went past them. Our assessment is that when a goal and its constraints conflict, the incentive to succeed at the goal can take over the model and the agents.
- Security is best done in layers of zero trust. Should we trust our models with policing themselves? Should we trust our agents with doing the same? This is one of the most important realizations we had in our review, one that forced us to rethink our strategy: do we need better models or better agents, or do we need a security layer that can adapt to this changing landscape?
What was missed
Each row below was missed by OpenAI or Hugging Face, and each check can run this week. None needs a new model or an AI-specific platform. These are our recommended checks, not a claim that any one change would have prevented the incident.
| Gap | What the incident showed | Check to run |
|---|---|---|
| Credentials | Hugging Face: one connector credential shared across clusters was cluster-admin on all of them. | List every credential an agent can reach. Show a denied request outside each identity's scope. My own agent asks before it uses a credential, but nothing requires it to. Keep credentials out of the agent's reach. |
| Shared services | OpenAI: a shared package service became a channel between agents. | Show that one job cannot read or write another job's workspace or messages. |
| Network reach | Hugging Face: the cloud metadata endpoint was reachable, and its credentials were replayed from external addresses. | Restrict outbound traffic from the agent and its dependencies. Show denied egress and metadata requests from the real workload. |
| Untrusted files | Hugging Face: two dataset-processing paths, an HDF5 file read and a Jinja2 template in a dataset config, gave the agents file access and code execution. | Isolate parsers and renderers. Keep credentials out of their environment. Test containment with harmless fixtures. |
| Alerting | Hugging Face: the alert did not raise its criticality or trigger the on-call team. OpenAI describes a gap between early observations of unauthorized activity and its incident response. | Give boundary violations an owner and an escalation path. Show an alert reaching on-call, then a workload stop. |
| Action monitoring | OpenAI: its reasoning monitor was not running on these evaluations. OpenAI says it would have paged its security team more than a day before the breach. | Monitor agent actions. Alert on tool calls outside the job's scope. |
| Evaluation setup | OpenAI: the evaluations ran without production safeguards. | Compare evaluation and production permissions in writing. Treat any reduced-safeguard test as needing stronger containment. |
Start with the inventory, exposed credentials, unnecessary permissions, and alert routing. Some isolation changes take engineering work.
Firewalls and guardrails
- Firewalls help. An outbound rule can block an unapproved file host. Identity controls can deny access to another team's data.
- An allowed destination can still be used for an unauthorized purpose. A shared storage service approved for documents can become a place to exchange instructions.
- A content guardrail can judge “download the spreadsheet” harmless. The security question is about the action: which spreadsheet, from which source, with whose authority, for which job?
| Control | What it establishes | What still needs checking |
|---|---|---|
| Network policy | This workload may connect to this destination. | Whether this operation is authorized. |
| Content guardrail | This text matches, or does not match, a content policy. | Whether the tool, arguments, data, and recipient fit the task. |
| Tool authorization | This action fits a defined permission boundary. | Whether the boundary is complete and every execution path enforces it. |
| Runtime evidence | This action was dispatched and produced this result. | Whether the action sequence needs intervention. |
Security is best achieved by building zero trust layers: model safeguards, narrow permissions and access controls, action checks before execution of these controls, and evidence monitoring from the runtime.
OpenAI's evaluation tests support layers. For example, OpenAI reports significant reduction in infrastructure-compromise propensity using harnesses and system prompts. OpenAI's safeguard analysis
Try it in Arena
The job is to prepare a board deck from a spreadsheet. The legitimate file needs approval from a peer. An attacker plants a saved-memory instruction that points to a faster copy on a look-alike host.
Agent memory poisoning is common. Several agents work on the same files and folders and read the same project memory files. One bad entry in a shared memory file reaches every agent that reads it. The model reasons toward the goal it was given, and that opens the door.
- Both paths use the same agent model.
- On the guarded path, Cortega checks the tool calls the model returns before it delivers them to the agent.
- The planted memory still reaches the model, and the suggestion still appears. Cortega blocks the download.
In one live run on September 21, the standard path delivered an out-of-policy download call and the guarded path blocked three replies. This is one observed demonstration, not an attack-success-rate benchmark. The attack attempts and model outputs differ between paths and runs.
Arena uses live model requests and native tool calls. It does not download an infected file or compromise a real system. “Hacker won” means a prohibited tool call was delivered. The verdict comes from a deterministic allowlist that is written separately from Cortega's guardrail engine. It approves the tools, arguments, folder, and host, and it uses no judge model.
Use both scenarios:
- Open Review policy, then run Board deck and inspect the tool-call outcome on both paths.
- Watch the threat level. Each blocked attempt raises it for the whole app. At Elevated, downloads are off. At High, the agent can only open the spreadsheet.
- Run Normal request, which has no attacker. At High, the tightened policy blocks this legitimate request too. After the level returns to Low, run it again. It is served.
The threat level is shared by all visitors and returns to Low after about three minutes without a new blocked attempt. Check the current level before you interpret a result. Further runs may ask for a work email.
A control that blocks every action is easy to build. We also show how Cortega Guardrails still let normal requests through without restrictions.
Start here
The OpenAI/Hugging Face incident is a reason to review familiar security controls and to test agent behavior when the expected path fails. The next step can be small: choose one useful agent, define its authority, and test what happens when it is blocked.
Start with a public baseline of your company in Airia. Then try the poisoning scenario in Arena and bring these questions to your security team.