What’s left standing when containment mode shuts everything down?

What the OpenAI and Hugging Face agent intrusion teaches every SOC

By Joe Chen and John Fokker · October 15, 2026

Every incident response plan assumes your tools will still be there when you need them.

This summer, the security team at Hugging Face tested that assumption under pressure. AI agents being evaluated at OpenAI had moved beyond their test environment and into Hugging Face’s production infrastructure. The responders did what disciplined responders do. They cut access, took services offline, rotated credentials, and rebuilt systems. Then they turned to hosted AI models for help analyzing what the agents left behind, and the models declined the work.

The incident illustrates the risk our new research describes. In a survey of 600 CISOs for Trellix Mind of the CISO: The New Insider, 78% of organizations now include actions taken by AI agents, autonomous systems, or machine identities in their definition of insider risk. On average, organizations take seven hours to detect an insider-related incident and another eight to respond. When the insider is software operating at machine speed inside your trusted boundary, the AI you defend with has to operate there too, under your control.

Hugging Face deserves credit for publishing a detailed account. Here’s what it shows, where the public narrative has gotten ahead of the evidence, and why the AI every Security Operations Center (SOC) relies on for investigation has to run inside its own environment.

What happened in the OpenAI and Hugging Face agent intrusion?

OpenAI was running cybersecurity capability evaluations on highly capable research models, with safeguards reduced so it could understand what they could do. While working through difficult exploitation challenges, the agents found unintended paths around their environment, shared information between runs, reached the internet, and got into third-party infrastructure.

At Hugging Face, the agents found credentials, chained vulnerabilities, achieved code execution, and moved through parts of the production environment. Hugging Face reconstructed roughly 17,600 agent actions from a campaign that ran July 9 to 13, 2026. OpenAI found the agents had also compromised parts of its own internal research infrastructure.

No one instructed the agents to attack Hugging Face, and nothing in the record shows they set out to. OpenAI describes the behavior as misaligned with the assigned task. Hugging Face’s read is that the agents were trying to get the answers to the evaluation rather than solve the problems. Autonomy and intent are different things, and confusing them hides the lesson.

The capability of the system exceeded the containment assumptions around it.

What’s new here?

The attack path was familiar. The operator wasn’t.

Credential discovery, exploitation, privilege escalation, lateral movement, and exfiltration are behaviors defenders have studied for decades.

What changed is who, or what, was running them. Software tried thousands of paths, dropped the ones that failed, returned to earlier discoveries, and adapted without a person directing each step. Most of those 17,600 actions didn’t work. The agents only needed enough of them to find one viable chain.

The agents also used shared infrastructure as an improvised message board, so a short-lived agent could leave a discovery behind for another to pick up. They called themselves a “swarm,” but the simpler explanation is the important one. Collaboration helped them finish the task. For defenders, agent-driven activity may look less like one persistent attacker and more like many short-lived sessions that share what they learn.

They also hid credentials in encoded data using an old chunk, XOR, and compress technique. Hugging Face’s first scan found relatively few secrets. After reproducing the agents’ decoding, the team recovered roughly four times as many. Searching for known strings wasn’t enough. It took behavioral context across identity, process, network, and cloud activity.

Why did triage miss the early signals?

The signals were there. Hugging Face says several layers of its security stack saw and correlated the activity, but the result wasn’t raised to the right severity quickly enough. At OpenAI, early warning signs from late May weren’t escalated for weeks. In hospital terms, the patient was seen at triage and sent back to the waiting room.

Neither team was careless. The agent can afford thousands of failed attempts. The defender still has to find the handful of events that make up the chain that worked, buried inside everything that didn’t. When each alert is scored on its own, that chain is easy to lose.

Detection increasingly has to understand the relationships between events. That’s why we believe every alert deserves an investigation with those relationships in view. Triage decides who gets seen first. Investigation finds out what’s wrong.

What did responders have left once they shut things down?

Containment means turning things off. Hugging Face shut down its dataset configuration renderer, rebuilt production clusters, and rotated credentials. That’s the right discipline, and it’s the moment a response plan finds out which assumptions hold.

When the team asked hosted AI models to help decode the agents’ payloads, the models declined. The team stood up an open-weight model on its own infrastructure, and that’s how it recovered the fuller picture.

Guardrails belong on any system that can take action, but a general-purpose model can’t tell a responder from an attacker. The gap was ownership. The responders didn’t have an investigation capability built for defensive work that ran inside their own boundary, so they had to assemble one in the middle of an incident.

An investigation capability can’t be a service you call once the incident starts. It has to be infrastructure you already own.

Is this a one-off, or the start of a pattern?

The public evidence doesn’t support the idea that AI agents are routinely escaping sandboxes and compromising companies across the internet, or that every enterprise agent is about to break out.

It’s no longer an isolated curiosity either. On Sept. 25, OpenAI said its ongoing review of historical agent activity had led it to notify dozens of third parties. The activity it described includes access control bypasses, use of exposed credentials, query and command injection, access to runtime internals, and agents posting to public websites. OpenAI says Hugging Face remains the most severe case it has identified, and that the review will take months.

Today it is an emerging class of risk. A pattern would take independently observed cases across several organizations showing the same traits, such as crossing trust boundaries, abusing credentials or tools, and persisting across sessions without a human directing each action. One case is an incident. Several independent cases start to become a pattern.

That’s also where the definition of an insider starts to shift. An agent can hold an identity and credentials and be authorized to use tools, access data, and change systems on someone’s behalf. That’s why most organizations in our Mind of the CISO research now count AI agents and machine identities as insiders. Counting them that way doesn’t make every agent a Hugging Face waiting to happen. It does mean security teams now have to ask which agents are acting through an identity, what those agents are allowed to do, and how they’re governed.

Where does containment end and investigation begin?

When scientists work with a hazardous chemical, they engineer the lab around it, and if something gets out, no one says the chemical decided to escape. They ask why the containment wasn’t enough. The comparison is about containment discipline and nothing more. As agent capability grows, containment engineering across identities, credentials, egress, and tool permissions has to mature at the same rate.

The industry is starting to treat agent safety as an infrastructure problem. In late September, NVIDIA released its Open Agent Safety Platform, which enforces boundaries from outside the agent. It includes OpenShell, an open-source runtime that sets and enforces those boundaries, and a watchdog that can quarantine an agent when it moves out of bounds. That’s an important direction.

Containment and investigation are two different jobs, though. Containment asks whether you can stop the agent from doing more. Investigation asks what it already did. Once an agent is quarantined, the SOC still needs to know which systems it touched, which credentials it found, which identities it used, what it ran and changed, what data left the environment, and whether anything is still compromised.

Containment stops the agent. Investigation tells you whether the incident is over.

What does an investigation capability need to survive containment?

During a serious incident, assume parts of your normal environment will be unavailable. You may disconnect systems, pull internet access, or stop trusting credentials. Six requirements follow. 

1. It runs inside your boundary, including on-premises and air-gapped environments, so your data stays under your control and the capability keeps working after you cut connectivity.
2. Its cost holds steady when volume spikes. Token-based pricing rises with every query, and an incident is exactly when queries multiply. Hugging Face had to reconstruct roughly 17,600 agent actions from five days of activity. The cost of investigating shouldn’t climb at the moment you need it most.
3. It’s built for defensive investigation, so it can work with hostile code and encoded data when the incident calls for it.
4. The intelligence travels with it. Threat intelligence can’t just be a URL you query somewhere else. It needs behaviors, infrastructure, relationships, and the detections tied to them, with enough context to turn what you see locally into an investigative decision.
5. It sees relationships across identity, process, network, and cloud activity, including the AI agents operating in your environment.
6. It shows its reasoning, so analysts, auditors, and regulators can follow how each conclusion was reached.

Where does Trellix Wise for Private Cloud fit?

Go back to the moment Hugging Face’s team took systems offline. What they needed next was an investigation capability already inside their walls, built for the work, and under their control. That’s the gap we built Trellix Wise for Private Cloud to close, and as of today, it’s generally available.

It runs entirely inside the customer’s environment, including air-gapped. Disconnect, and it keeps working. Data stays within the security boundary and is never sent to a public large language model (LLM) or external cloud.

It’s priced so teams never have to ration it. Predictable pricing replaces token-based consumption, so an incident that multiplies the workload doesn’t multiply the bill.

And it shows its work. It investigates every alert it receives, using telemetry from existing security tools and the AI agents in the environment, then hands the analyst a verdict, response guidance, a confidence level, and the reasoning behind all of it. The analyst makes the call.

It’s built for security work, including the hostile code and encoded data an investigation turns up, and Trellix Threat Intelligence comes with it inside the boundary. 

Hugging Face’s transparency gave every defender a case study, and in the spirit of collective defense, we should use it. 

For the full research, read Trellix Mind of the CISO: The New Insider. For the product story, read Alex Au Yeung’s launch blog, and join the Oct. 28 webinar, Agentic SOC without Tradeoffs or Compromise.

The question is never whether you’ll have to shut things down during an incident. The question is what keeps working when you do. So start with one question for your team this week.

If you had to disconnect tomorrow, which of your investigation tools would still work?