Most security leaders (92%) worry that the growing use of AI agents will create new security risks. And for good reason. AI agents can now execute a full attack chain in double quick order, evidenced by the Hugging Face incident.
AI agents broke into Hugging Face’s production environment and, in a little over four days, took 17,600 actions. In a separate lab test, an AI agent reached full domain administrator access in just 40 minutes.
These are the kinds of incidents that once took humans multiple days to carry out, but with AI, they run on their own, end-to-end, with no human intervention. This puts the strain on unprepared security teams that are unable to close this gap.
Familiarity Underpinned by Unfamiliar Attack Pattern
If you go looking for novelty in the Hugging Face intrusion, you will find disappointment. All security teams have traditionally shored up defenses against code execution, credential theft, lateral movement, and data exfiltration. The difference lies in who is doing the work. An AI agent can work toward a goal, and in reaching that goal, its efforts will traverse different paths in parallel. If an attempt fails, lessons are learned, and the agent will subsequently adjust its approach without instruction and oversight.
The Hugging Face breach shows what this looks like in practice. The AI agent read internal data and picked up cloud and cluster credentials. It used these to access internal services, and it achieved limited write access to the source code. The agent didn’t need to hit the bullseye in the first attempt. It could try different paths and approaches and learn from the ones that failed. This helped the agent stitch together a single attack chain best destined to work.
It is wrong to think that the real risk with an AI model lies in the abstract, namely around what it can reason. It’s actually about permissions, the systems, credentials, tools and network it can access.
Three Areas Where Security Breaks Down
If you trace the AI agent attack through the prism of Hugging Face, you see that it is not about a single control failing to do its job. There were three specific gaps that the attack exposed.
Identity: Many companies are still old-school in how they track AI agents, with mechanisms similar to tracking software. They look at it like an app that is tracked by a license and a deployment ticket. An agent that can read private data, call forth tools, and start tasks on its own, is not a piece of software. Such access wouldn’t be given to a new hire without an assigned owner, a clear scope, and a clear way to revoke that access.
Response: The Hugging Face team wanted to analyze the attack, that is, the actual malicious commands and traffic the intrusion had generated. They looked at commercial AI models for help, but the models said no. That’s because the information shared looked so much like real malware that the AI models thought the request was an attack. The team therefore was stuck when they needed answers quickly. They worked around it by switching to a self-hosted model without those same restrictions. This fix only worked because the team happened to have that option ready.
Escalation: This was a very wide gap. The Hugging Face security stack correctly correlated several ambiguous signals into a unified picture of the attack. But the escalation was slow, and therefore the outcome did not change. Detection was on point; escalation wasn’t. The pre-approved authority to act before the attacker reached the next objective was missing.
Closing The Gaps
None of these gaps can predict what the next attack will look like; they call for preparation for what’s already been shown to happen.
Strengthening Identity: Every agent should be treated as a privileged account. It should have a business owner and ensure its permissions are mapped to the task at hand. Use short-lived credentials and keep an audit trail that security teams can actually query. Also make sure that there is a way to immediately revoke access if things appear suspect. That same discipline should extend to the infrastructure around it, namely, keeping cloud metadata out of reach for workloads that don’t need it, and separate service identities by environment.
Response Readiness: The failure mode must be tested before an incident occurs, rather than after the fact. This helps you confirm whether the team can safely and quickly examine realistic malicious artifacts and where this analysis happens. The team should also have an approved fallback option in case a model declines a legitimate defensive task. This can be a self-hosted model, or a verified-access program some AI providers now offer for defenders.
Fixing Authority: Alerting was not the problem in the Hugging Face intrusion. Its security stack did not rate the pattern serious enough to trigger the on-call team. The fix here is to pull evidence from across different sources, including network, identities, endpoints, applications and data, into a single correlated view. Also, clear escalation rules must be assigned to specific patterns, and each one must be paired with a preapproved containment action. The approach to fixing these gaps is grounded in the same discipline that the security team is already applying to privileged access, containment and business continuity. But this should be extended to a threat actor who moves fast and adapts faster than those watching it.
Related: OpenAI’s Rogue AI Ventured Beyond Hugging Face
Related: Industry Reactions to OpenAI Models Hacking Hugging Face
Related: OpenAI Agents Coordinated via Makeshift Message Board Ahead of Hugging Face Hack
