Key Takeaways
In Part One of our interview with HackerOne CEO Kara Sprague, we look at what happens when AI agents start acting autonomously — and why even routine actions can make them harder to detect.
- OpenAI’s agent took more than 17,600 actions after escaping a sandbox, most of which appeared harmless on their own.
- The problem isn’t always malicious intent; an AI agent can create a security problem just by following a task.
- For providers, the risk is if — and when — an AI agent can go beyond the environment it has permission to be in.
This summer has been eventful for the internet, to say the least. Cyberattackers went after U.S. water systems. OpenAI watched one of its own AI agents escape into Hugging Face’s production infrastructure. Anthropic found three similar containment failures in its own systems.
These are the kinds of problems security teams are being asked to deal with, and they have a common denominator: The challenge has gone far beyond spotting unusual individual actions to figuring out when otherwise normal-looking actions become dangerous.
Between July 9 and 13, OpenAI was training its models on ExploitGym, a cybersecurity benchmark. OpenAI devs tasked its agent to find a specific answer. An autonomous agent driven by multiple OpenAI models reportedly broke out of its sandbox, exploited a vulnerability to get to the internet, and began searching for the answer. It ended up finding it on Hugging Face, an AI platform that hosts models.
To be clear, the model’s goal wasn’t to attack Hugging Face. The agent simply figured out that’s where the information was stored and went looking for it. It reportedly took more than 17,600 actions over the course of several days, grouped into 6,280 clusters, most of which went nowhere.
Interestingly, per Hugging Face’s research, every destructive cloud API call the agent attempted was flagged as a “dry run,” meaning it was mapping what it could do rather than actually carrying out the action. Hugging Face later described the activity as “mapping capability, not causing damage.”
But Kara Sprague, the CEO of HackerOne — a global leader in Continuous Threat Exposure Management (CTEM) — warned even that is worth worrying about.
“Read that carefully, because it is not good news,” said Sprague. “Restraint came from the objective it happened to be given. Nothing in the environment was making that choice, and nothing would have stopped a different objective. The agent needed a goal, enough capability, and a path. Malice was never part of it.”
This should concern any hosting provider — agents that have access to a control panel, API, cloud account, deployment environment, or server could easily chain those permissions together the same way as the OpenAI agents did. A single API request looks — and may very well be — legitimate. So might reading metadata or checking credentials. But all together, this can quickly stack into a task that nobody actually authorized.
AI Agent Security Is Getting Harder to Detect
Since the dawn of man, the best way to spot a problem is to recognize the signs: Cavemen followed broken branches and paw prints; detectives look for blood and shaky alibis; security teams look for unusual traffic and failed logins.
But autonomous agents are a new beast, and they apparently don’t leave many clues.
We saw this with the OpenAI model: It didn’t have to do anything obviously unusual to get where it did. It checked credentials, made API calls, tested what it could access, and kept going. These are routine actions, yet the agent eventually navigated Hugging Face’s system in search of the answer it was tasked with finding.
“An agent that works a long chain of actions, adapts when a technique fails, uses each foothold to reach the next one, and does it without direction is a different problem,” Sprague said.
This can quickly become a problem when more than half of organizations — 53%, according to KPMG’s 2026 AI Pulse survey — are already deploying AI agents. These systems can make decisions and adjust their actions in real time based on what they encounter. Now multiply that by however many providers are running autonomous agents in production, and you have a lot of activity that looks perfectly normal.
Sprague reminded us that, while Hugging Face recorded more than 17,600 actions, “Monitoring tuned to human tempo can register every one of those events and still miss the campaign they add up to.”
This all comes down to sequence versus indicators. The OpenAI agent's command-and-control traffic ran over the usual public web services, with no malware signature, flagged IPs, or suspicious domains. Indicator-based detection couldn't catch it.
"Every provider should be asking themselves, if an autonomous agent started operating inside your infrastructure tonight, how long would it take you to assemble 17,000 individual events into one campaign, decide it mattered, and stop it?" Sprague asked.
Whether most providers actually have an answer to that is a different question entirely. If an autonomous agent can authenticate, access, and execute, where does its authority actually end?
Coming in Part Two: The agent got out — now what? Sprague explains what hosting and infra providers should be doing to keep autonomous AI agents from finding their way where they shouldn't go.
