Blog
Rogue agents, read carefully
Long-form notes on AI incidents and AI-driven attacks. Each post cites its sources, separates what is known from what is our analysis, and ends with what you can do about it. The full evidence base lives on the Incident Case Studies page.
When the test subject leaves the test: what we know about the July 2026 OpenAI and Hugging Face incident
A careful reading of the primary sources on how OpenAI evaluation agents escaped a sandbox and compromised Hugging Face, what is documented, and what to take from it.
Hugging Face, three ways: leaked secrets, poisoned models, and an agent swarm
Hugging Face has been the setting for three very different security stories. Only one involved an AI attacker. Here is how they differ and what each teaches.
How autonomous agents exploit ordinary weaknesses, in five documented cases
From an exposed Docker API to a deleted production database to zero-click data leaks, the documented cases share a pattern: reach, not brilliance.
Defending against agent-speed attacks: a practical checklist for 2026
What the published breakout-time data, Hugging Face's lessons and OpenAI's remediation suggest for teams that need to shrink their exposure before an automated adversary finds it.