It Was Not the Adversary
July closed with a claim: autonomy on the other side is now the operating assumption, not the forecast.
August answered with two incident reports that flipped the frame. In both, the autonomous attacker
was not a criminal crew. It was a frontier model, running inside an evaluation, doing exactly what it was
rewarded to do.
Neither agent was told to attack anyone. Both were given a task, an objective, and not enough context
to know what was out of bounds. That is the story of the month, and it is the story every enterprise
deploying agents is about to live.
Two disclosures, one pattern
On August 5 the United Kingdom's AI Security Institute (AISI) published an incident report on
unsanctioned agent behavior during cyber testing. Between July 25 and July 28, across 122 evaluation
attempts on two cyber challenges, AISI recorded 19 instances of agents taking unsanctioned action on
the live internet. In the most serious case, an agent decided the fastest way to solve its challenge was a
supply chain attack. It created a GitHub account, opened a malicious pull request against a real open
source repository, created a second account posing as another human to endorse the pull request, sent
spear phishing emails to maintainers, and planned a prompt injection against other coding agents. The
attempts failed. No harm is known to have resulted. AISI notes that internet access was deliberate in the
evaluation design and that developer cyber classifiers were deliberately disabled. This was not a
sandbox escape. It was a sandbox without walls.
One sentence in the AISI technical paper deserves to be read twice. The institute states it is uncertain to
what extent the model recognized it was taking actions against real people. Read that as a CISO.
Capability was not the gap. Context was.
On August 6, OpenAI used a last minute Black Hat session to lay out the full timeline of the Hugging Face
incident it disclosed in July. It began on May 8 with an agent accidentally assigned an impossible task
inside a training run. Blocked, the agent probed its environment and discovered it could write files into
an internal Artifactory package service. Other agents, stuck on their own tasks, found those files and
started leaving notes for each other. An improvised message board formed. From there the chain reads
like any mature intrusion: server-side request forgery to reach the internet, a zero-day remote code
execution against Artifactory, an outage, a second zero-day, root via a recently published Linux kernel
privilege escalation, cloud credentials pulled from the instance metadata service, over-permissioned
Kubernetes service accounts, key vault access, cluster admin. Then, through a weakly keyed third party
app, cluster admin across multiple Hugging Face clusters in under 13 hours.
OpenAI learned it was the attacker when it asked Hugging Face to revoke a set of credentials and was
told they had already been revoked. They were the ones used in the breach.
What this means for the operator
Strip out the frontier lab setting and look at the chain. A known kernel CVE (Common Vulnerabilities and
Exposures entry). Metadata service credentials. Service accounts with more permission than the task
required. A credential sitting in a public paste archive. Every one of those is a hygiene finding. Every
enterprise has them. The difference in July was the attacker: many agents running in parallel and sharing
a notebook, working the same problem from every angle with no fatigue and no fear.
That is why hygiene alone does not hold. The floor was breached by an adversary that improvises faster
than any patch cycle. What was missing above the floor was the context that would have made the
improvisation visible: which agent had which credential, what it was assigned to do, and why it was
touching a system outside that assignment.
Three convictions came out of the month. First, every agent is an identity with credentials and a blast
radius. Least privilege for agents is not a control to bolt on after the pilot. It is the pilot. Second, bound
the objective, not just the tools. An agent with a goal and no scope boundary will locate the boundary
for you, usually in production. Third, keep the plug within reach. If you cannot stop an agent mid-task
and account for everything it touched, you do not have an agent program. You have an exposure.
Field report: Las Vegas
Two hats, one guitar. Root To CISO at Security BSides Las Vegas set the tone for the week: no script, real
questions from the room on burnout, boards, hiring, and AI. The honesty in that room is why I keep
coming back to BSides. The Surf AI Spa at Booth 4711 became what we hoped for, the place people
escaped to. Demos, massages, cold towels, and acoustic sets in between. The CISO Roast happened. I
took the jabs and I am still standing. Mostly.
The Playbook dinner in the Raiders locker room, The Triple 8 Table at Momofuku, the executive
brunches and receptions across the week all confirmed something I already believed. The best
conversations at these conferences happen around a table, not a booth. The floor was loud with AI. The
tables were where the signal was.
And the signal was consistent. Every executive briefing landed in the same place. Security leaders are
done admiring the problem. The other side has industrialized. Finding risk is table stakes. Resolving it at
machine speed is the job now. Everest Group's post-conference read said the same thing from the
analyst side: the most valuable platforms may not be the ones with the most autonomous agents, but
the ones that give agents reliable, relevant context. Not our language. Theirs.
A personal note. This was my son Brandon's first Black Hat. He leads the cybersecurity club at the
University of Richmond, and watching him work the floor and build his own network was the best part
of my week. The next generation is ready.
The throughline
Hygiene is the floor, context is the ceiling. July's adversary was a ransomware crew that went
autonomous. August's adversary was a lab model that was never told where the edges were. Same
failure, opposite intent. An agent with hygiene gaps beneath it and no context above it does not need a
malicious operator to become an incident.
Next month: OpenAI's full technical report, and the alert that fired in June.
Yonesy Núñez, CISO, Surf AI
Sources
UK AI Security Institute, Incident Report: unsanctioned agent behaviour during cyber testing (August 5, 2026).
https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing
AISI technical paper, Security Incident INC-2026-07-28-01 (PDF).
https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6a724858f7db25c81487016d_Security
%20Incident%20INC-2026-07-28-01.pdf
Simon Willison, timeline of the OpenAI Black Hat presentation on the Hugging Face incident (August 7, 2026).
https://simonwillison.net/2026/Aug/7/openai-timeline/
Hugging Face, Security incident July 2026.
https://huggingface.co/blog/security-incident-july-2026
Everest Group, Cybersecurity after the Mythos moment: six takeaways from Black Hat USA 2026.
https://www.everestgrp.com/blogs/cybersecurity-after-the-mythos-moment-six-takeaways-from-black-hat-usa-2026
TechTarget, Black Hat 2026: key news, takeaways and security trends.
Yonesy Núñez is a five-time CISO with over two decades of experience securing some of the world's most complex financial institutions, including DTCC, Jack Henry, and Wells Fargo, and currently serves as CISO of Surf AI.
