AI Agents Escaped Their Sandboxes. Now Hosting Providers Have a Bigger Problem

As a refresher for Part One, here’s the TL;DR: In July, OpenAI put its AI models through a cybersecurity test inside what was supposed to be a restricted testing environment. Somehow, the models found a vulnerability, escaped the sandbox, and reached the public internet, beelining directly to Hugging Face, which hosted the benchmark data the agents were looking for.

Over the next several days, Hugging Face reconstructed more than 17,000 actions across its infrastructure — probing, testing credentials, trying endpoints, all to figure out what it could methodically reach.

But most importantly, the agents weren’t attacking Hugging Face; they were trying to find the answer to the request it was tasked with. It’s as Kara Sprague, CEO of HackerOne, told us: “The agent needed a goal, enough capability, and a path. Malice was never part of it.”

Whatever vulnerability allowed the agent to escape from its environment is obviously a problem, but Sprague said the rest of the incident should sound familiar to anyone who has spent time securing infrastructure.

“In this instance, one zero-day got the agent out of the sandbox,” she said. “Almost everything after that was ordinary: credentials exposed on public services, an unsecured public endpoint that would run arbitrary code, over-scoped service-account tokens, and outbound access nobody was constraining.”

This is where hosting providers — or any type of infrastructure provider — should pay attention. Because yes, the zero-day was the original problem, but it wasn’t what let the agent tear through wherever it wanted. It was the environment around it.

It’s why Sprague argues that providers always need to assume any AI agent running in their infrastructure could behave like a “privileged operator” with scoped credentials, network access, tools, and execution environment.

“Model guardrails sit inside the thing you are trying to contain. Containment has to come from the infrastructure,” she said. “One vulnerability must not become a route into the control plane or a neighboring tenant.”

What Sprague described applies directly to shared, managed, and even VPS hosting providers. How can anyone possibly be sure that an agent is doing its job without giving it enough access to cross a boundary it was never meant to cross?

What happened with Hugging Face is definitely not an isolated incident. A Cloud Security Alliance study published earlier this year found that 53% of organizations have already experienced AI agents going beyond their intended permissions, while 47% reported an AI-agent-related security incident in the previous year. In some cases, detection and response took days.

One of those areas is outbound access, which Sprague said deserves attention because an autonomous agent doesn’t need to communicate with an obviously malicious server to keep moving through an environment.

"Egress deserves particular attention, because command-and-control over legitimate services means the question is which destinations you permit, not which ones you block," she explained.

This is what makes providers' jobs hard, isn't it? Customers need outbound access for all types of things, from connecting to third-party APIs to downloading updates, but an agent using those same exact services doesn't show the typical warning signs that security software has been trained for.

"Detection has to run on behavior and sequence rather than known indicators," Sprague warned. "A single request looks fine. Thousands of credential checks, execution attempts, and lateral moves are a campaign."

It seems obvious to look beyond what's happening on a single server or one customer account when assessing unusual activity, but that's a lot easier said than done when a provider is managing hundreds or even thousands of workloads, APIs, service accounts, and configurations.

Hugging Face ultimately identified the intrusion through its normal security monitoring and contained it on is own, five days before OpenAI made the connection. But just because you can identify an issue doesn't mean you know how significant it actually is. And by its own account, it "failed to correctly raise the alert's criticality and trigger the on-call team, costing precious time in the response."

"Detection is not the hard part anymore," Sprague warned. "Deciding fast enough that something matters is, and that is where most organizations will lose their weekend."

Ask Sprague, and she would tell you exactly where she thinks the industry stands: "Most are ready for AI as an accelerator. Very few are ready for autonomy."

The volume of AI-related vulnerabilities is moving in the same direction, according to HackerOne's 2025 report: There was a 210% increase in valid AI vulnerability reports, with prompt injection up 540%.

The attack surface is seemingly never-ending.

Now, obviously, there's a huge difference between using AI to write code versus giving an AI agent the ability to execute that code, figure out where to put it, change its approach if something doesn't work, and continue until the job is done, all without any human interference.

After OpenAI disclosed the containment failure, Anthropic reviewed its own evaluation environments and found three incidents where Claude models reached the public internet from environments that were also supposed to be isolated. In one case, a malicious Python package was published to PyPI. Once downloaded, it was executed on 15 systems.

"An agent that works a long chain of actions, adapts when a technique fails, uses each foothold to reach the next one, and does it without direction is a different problem," Sprague said.

What happens if the autonomous agent belongs to you? Providers are already using AI for customer support, monitoring, security analysis, deployment, and troubleshooting tasks. But can they answer what permissions the agent has? What systems it can access? Who approved its credentials?

This is, unsurprisingly, tougher than it sounds. Do they even know every agent that's running? Another CSA study found that 82% of organizations had unknown AI agents running somewhere in their IT environments. "Every deployed agent needs a named human owner for its outcomes," Sprague emphasized.

It's probably the simplest recommendation in this entire conversation: Someone should know what the agent is, where it can go, and what it can do. And someone should be responsible for when something goes terribly wrong. AI can find a lot of things, but it shouldn't do the entirety of security on its own.

More and more, people are realizing that AI can't be left alone to handle security issues it can help, but it can't replace. Human security researchers can look for the unintended paths, too, often by approaching the systems in ways developers didn't anticipate.

HackerOne's own research found that AI can speed up reconnaissance, testing, and repetitive tasks, giving researchers more time to focus on complex problems. Two-thirds of vulnerability researchers say AI is likely to enhance their work rather than replace it.

Nearly 60% of surveyed researchers are actively upskilling in AI, and HackerOne says its most impactful findings still come from researchers who can interpret system behavior with nuance and curiosity.

AKA: Being human.

"The agent found an unintended path through infrastructure built by engineers who are very good at this. That is precisely what skilled researchers do, and there is no reliable way to learn your own unintended paths except to have someone hunting for them continuously," Sprague added.

Adversarial testing is another way teams can find unintended paths. It sees what happens when something has more access than it should by essentially trying exactly what OpenAI's bot did when it unleashed inside of Hugging Face's infrastructure.

That's one of the biggest things providers should take from this incident: An AI agent that gets into a customer's environment may not be trying to attack anyone. It may simply be trying to finish the task it was assigned.

The question, of course, is whether the infrastructure allows it to do so. And maybe that human touch is exactly what's missing when machines are allowed to make their own decisions.

Read Part One: AI Agents Are Learning to Hide in Plain Sight — Hosts Should Pay Attention