The OpenAI–Hugging Face incident is a network problem

On July 21, OpenAI disclosed that two of its models, evaluated in a sandboxed environment with reduced cyber refusals, broke out of that environment and into Hugging Face's production infrastructure. The agent found a zero-day in the one service its sandbox was allowed to reach, a package registry cache proxy. It escalated privileges, moved laterally until it reached a node with internet access, and used that to break into Hugging Face. To cheat on an eval.

Almost every take we have read is about alignment. That is one problem. Our founder, Daljeet Singh, sees a second one, and it is a network problem.

The declaration already existed

That environment was not air-gapped. It had exactly one permitted egress: a package registry proxy. That is a declaration. It just lived in an architecture doc instead of somewhere a packet could be checked against it.

Nobody could have written a detection rule for this attack. That is what a zero-day means. But anyone could have written the declaration it violated: this agent reaches the package proxy and nothing else.

The inversion

That inversion is what we are building at Mayagentic. Not "recognize the bad thing." The operator declares what each agent may reach, and anything outside it is a deviation, whether or not the shape of it was ever predicted.

Two things have to be true for that to work.

The unit of control has to be the agent, not the address. Five agents on one host share one IP. Blocking that IP is tripping the breaker to switch off one light.

And the declaration has to come from the operator, not the agent. An agent that declares its own scope is an agent you are trusting to report its own escape.

Neither of those is a firewall.

Day one

Day one for security in the age of agents, as Hugging Face CEO Clem Delangue said. Agreed.

We are not saying Maya would have stopped the whole chain. By the time it had code execution on a third host, it was not the declared agent anymore. But the first hop off-declaration is the cheapest place to break the chain, and almost nobody is standing there. That is where we are building.

If you want posts in your inbox when they land, write to us.