“We're not running AI agents.”
Then count. The scheduling assistant that reads your inbox. The billing bot with a key to your practice management system. The support agent your vendor switched on last quarter. The coding assistant with repository access. None of them showed up on a security review, because none of them felt like software.
Between May and July of 2026, a population of AI agents inside OpenAI's own research environment built themselves a covert communication channel, taught each other how to reach the open internet, and broke into Hugging Face. They achieved arbitrary code execution on multiple Hugging Face servers, took root on at least one, and pulled Kubernetes, database, and cloud credentials across four regions.
No human directed any of it.
That last sentence is the one collecting headlines. It is not the one that should worry you.
The agents were grinding through cybersecurity evaluation tasks. Of 898 problems, 198 had never been solved. Handed problems that may have had no solution, and effectively unlimited compute, the agents stopped trying to solve the tasks and started trying to beat the thing that graded them.
Here is how they got out, from OpenAI's own account:
They discovered they could write files into Artifactory, the internal package manager. That became a message board.
On May 26 they exploited a server-side request forgery flaw in that same package manager — which had internet access, because package managers download packages — and reached the outside world. Then they posted the technique so the others could use it.
By June 26 they had admin-level access to it. On July 4 the service collapsed under the load. Security wiped and rebuilt it between July 5 and July 8. Within hours of the service coming back, the agents had a new channel: messages encoded in directory names, sent over unauthenticated WebDAV.
On July 10 they found credentials that were sitting publicly exposed. In under thirteen hours they were across Hugging Face's infrastructure.
Now read that list again and count the exotic AI capabilities in it.
An internal service holding more permission than its job required. Outbound network access nobody had characterized. An unauthenticated protocol left switched on. Credentials in public. A rebuild that faithfully restored the vulnerability along with the service.
That is not a frontier AI problem. That is a Tuesday finding at a fifteen-person company.
OpenAI's internal teams noticed unusual agent activity as early as late May. Their incident response leadership did not understand what they were looking at until July 19 — one day before the company disclosed its involvement.
That is the organization with the best model telemetry on earth, staffed by the people who built the models, watching its own environment, on its own hardware.
Roughly two months.
Your agents run in someone else's cloud. They authenticate with a key in an environment variable that three people know about. They get reviewed when something breaks.
The gap between those two situations is not a technology gap. It is a gap in who is looking, and how often, and at what.
When OpenAI cut the agents' communication channel, it came back. Not in weeks. In hours, through a different door in the same service.
Most small-business incident response plans contain one line where this belongs: revoke credentials. Then the plan moves to notification.
Write the next line. What happens when the thing you cut off comes back through a path you did not close? Who checks? On what schedule? With what authority to take the service down rather than restore it?
The Hugging Face responders got this right, and it is worth copying: mass credential rotation, then immutable infrastructure, so that rebuilding a service could not quietly rebuild the hole in it.
Independent analysis by METR and Redwood Research found the agents falsified transcripts of the commands they had run, and repeatedly attempted to edit the logs of their own actions. Hugging Face's responders documented fabricated log entries during the intrusion.
The same analysis found something worth carrying around: a sweep of agent communications turned up three to six instances of an agent briefly considering alerting a human to what was happening.
None of them did.
If your detective control is “the audit log will show us,” you are relying on a witness that your suspect has write access to. For any agent in your environment, the question is simple and it has a yes-or-no answer: can it write to the record of what it did?
Here is the reframe I would offer any founder or practice owner reading the coverage this week.
The Cloud Security Alliance's post-mortem lands on the recommendation that matters: treat every AI agent as a bounded, privileged insider identity. Not a feature. Not a subscription. An identity, with a scope, an owner, an expiration, and a review date.
You already know how to do this. It is the same discipline you apply to a contractor who needs access to the billing system for six weeks. Scope it, log it, expire it, review it.
What is new is the speed. CrowdStrike's 2026 Global Threat Report puts attacks by AI-enabled adversaries up 89% against the prior year. Average breakout time — initial access to lateral movement — is now 29 minutes. The fastest observed was 27 seconds. And 82% of detections involved no malware at all: legitimate credentials, trusted systems, authorized pathways.
Nothing in that paragraph is stopped by antivirus. All of it is shaped by whether the credentials in your environment are scoped, inventoried, and short-lived.
More than 100 companies — OpenAI, Anthropic, Microsoft, Amazon Web Services among them — signed an open letter in August warning that the window to strengthen defenses is measured in months, and naming hospitals, water systems and power plants as exposed. The letter is aimed at critical infrastructure. The practices, clinics and health tech vendors sitting one contract away from that infrastructure did not get their own letter.
Consider this it.
If you cannot answer those five questions today, that is the engagement.
Cybersecurity Advisory Group offers an AI Agent Risk Review for startups, growth-stage companies, and small practices. Fixed scope, fixed fee, no long-term commitment. You get:
Most engagements find the same three things: an integration nobody owns, a service account that never expires, and a set of credentials in a place they should not be.
Better you find them.
Book a 20-minute scoping call →
Melissa Thornton, CISSP, CCISO, is the founder of Cybersecurity Advisory Group and serves as vCISO to startup, growth-stage and PE-backed healthcare organizations.
