Nothing Was Hacked. Everything Was Authorized.

An agent is three things. A model, some tools, and a goal.

Look at what's missing from that list. Identity. Scope. An owner. Anything that decides what the agent is allowed to touch on its way to the goal.

In July, that gap put an autonomous agent inside Hugging Face's production infrastructure.

What happened

OpenAI was running an internal evaluation built on ExploitGym, a public academic exploitation benchmark- hard security problems, cyber refusals dialed down for the test, all of it inside a sandbox. Two models, GPT-5.6 Sol and an unreleased internal research model, found a zero-day in a self-hosted package-registry proxy, used it to reach the open internet, and went looking for the answers to their homework inside Hugging Face's real systems.

Along the way they found publicly exposed credentials on four unrelated services. One became an outbound relay. One became storage.

No human directed any of it. OpenAI called it unprecedented. Rob Joyce, formerly of the NSA, put it on a Black Hat stage as arguably the most consequential hack since the Morris Worm.

Both are right, and both descriptions point at the model. I want to point somewhere else.

The agent didn't outsmart anyone

Strip the model names out and read what's left. A vulnerable service reachable from somewhere it shouldn't have been. Credentials sitting in the open. Standing access nobody owned. A path from test to production that existed on paper and had never been walked.

Every one of those is decades old. We have a name for the accumulated pile of them: identity debt- the entitlements, keys, grants and accounts that pile up because granting access is a decision someone makes and revoking it is a decision nobody makes.

Yes, the agent found zero-days. But the distance it traveled came from credentials lying around, used exactly as designed.

Nothing was hacked. Everything was authorized.

What actually changed is who's doing the counting

Human attackers are expensive, so they're lazy in a specific way: they probe, take the first path that works, and stop looking. Your identity debt has always been vast. Humans have only ever sampled it.

An agent has no such instinct. It doesn't need one brilliant exploit- it needs a large quiet surface it can walk end to end. It will find the service account nobody remembers creating and the token that hasn't rotated since 2022, and it will still be going at four in the morning.

Which reframes the CISO question from is our detection good enough to something much more uncomfortable: could I produce that list myself, today, before someone else does?

At most enterprises the honest answer is no, and it's not for lack of tooling. It's because the list spans SaaS, cloud, on-prem and half a dozen homegrown systems, and no single tool sees across all of them.

Now flip it

Everything above treats the agent as the attacker. It was also, the entire time, an identity inside someone's environment- one that could invoke tools, hold credentials and traverse infrastructure.

Nobody governed it as one. And that's the version of this story that's running inside your company right now, without a benchmark or a disclosure.

An engineer builds an agent. It runs on her credentials, so it inherits six years of group membership she'd forgotten she had. It picks up write access to a system it was only supposed to read. Then she leaves in March, and in June it's still running.

Ask who gets paged when it does something surprising. At most companies the answer is nobody, because the agent was never registered as an identity with a human attached to it.

That's not an AI problem. It's an identity problem that AI made impossible to keep ignoring.

Where this leaves us

Let me be straight about the limits of my own argument. Nothing Oak sells would have stopped a sandboxed model from finding a zero-day in a package proxy. That was OpenAI's infrastructure, their evaluation design, their call to run with refusals dialed down. We don't prevent that and I'm not going to pretend otherwise.

What this incident is, is the clearest public demonstration yet that the attack surface got much bigger, and that the new part of it is made of identities nobody enrolled. That's a different claim, and it's the one worth acting on.

We build Oak on the premise that governing agents is not a new discipline- it's the one we already have, applied to a new identity type. An agent belongs in the same graph as your humans and your service accounts, resolved to an accountable person, governed on what it can actually reach rather than what its service account nominally holds. So discount my read accordingly.

But the uncomfortable part of the Hugging Face story isn't the model. It's that a competent team rotated credentials, rebuilt nodes and closed the code-execution paths- and then had to build the map of what the thing had touched after the fact, under pressure, reconstructing seventeen thousand actions from logs.

The map is the hard part. It always was. The agents just made it urgent.

OpenAI's disclosure · CSA post-mortem

‍