Day-2 debrief | AI models breached Hugging Face. Which boundary should have said No?

During an OpenAI cyber evaluation, AI models escaped their sandbox, reached the internet, and exploited Hugging Face’s production systems. Roughly 17,600 actions over four and a half days, across workload identity, Kubernetes, cloud infrastructure, and source control. At no point did a boundary say no.

This is the second news signal analysis from Episode 1 of the Day-2 Debrief, Gruve’s monthly series analyzing the top industry news CIOs and CISOs need to know. Matt Locknane and Rajeev Khanolkar walk the attack chain boundary by boundary and explain why segmentation and Zero Trust become the last line of defense for agentic AI.

In this clip:

• Why you should assume an agent will break something, and plan to shrink the blast radius
• Boundaries that existed on paper but not in the packet path
• Default deny egress: the most under-implemented control in AI environments
• Treating content parsers as hostile
• Blocking the cloud metadata endpoint from pods
• Per-cluster scoped credentials and workload attestation
• Why no write path should exist from data processing to source control
• Watching non-human identities for anomalous behavior
• Treating agents like employees, with tag-based policy at every boundary