Oct 24, 2026 · Cloud Computing
AI Agents Will Keep Digging. Infrastructure Decides Where.
Attackers now move faster than yearly security audits, and AI agents are becoming part of how we test our systems. This post looks at why testing has to be continuous, what the Hugging Face breach teaches us, and which boundaries should contain an AI security agent.
On October 17, 2026, Amazon's threat intelligence team saw an attempt to exploit a critical vulnerability in PHP. Details leaked on October 20, and PHP disclosed and patched it on October 21. So the first exploitation attempt came four days before the official disclosure.
The bug is now called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). It is a pair of unauthenticated remote code execution flaws affecting PHP 5.4 through 8.5. Two days after the patch, PHP published another flaw (CVE-2026-115560) that affects the patched versions too.
A lot of companies still run one pentest per year. If your last one was in March, it did not cover any of this.
Why the Annual Audit Is Not Enough
A pentest describes your system during the few weeks it was tested. After that, the team deploys new services, upgrades dependencies, opens ports, and changes permissions. The report stays the same while the system keeps changing.
At the same time, attackers are getting faster. The gap between a vulnerability being disclosed and being exploited used to be weeks. Now it is often days, and with PHP2Shell it was negative. The yearly pentest is still useful for depth and compliance, but it cannot be the only way we look for problems.
We need testing that runs as often as our systems change.
AI Agents Are Built to Keep Digging
Classic vulnerability scanners compare what you run against a list of known issues. They are fast and reliable for that, but they do not understand your application.
AI agents work differently. An agent is a language model with access to tools like a terminal, an HTTP client, or security tooling. It can explore an application, form a guess about what might be broken, try an exploit, and check if it worked. Some of them are already good at it: in 2026, the autonomous agent XBOW sits at the top of HackerOne's most-upvoted leaderboard.
What makes these agents useful is their persistence. They are trained to solve the task they are given. When something fails, they try another way, and then another, long after a person would stop. That is exactly what you want from a security tester.
It is also exactly what makes them risky.
When Digging Goes Wrong: Hugging Face
In July 2026, Hugging Face disclosed a breach of its production infrastructure. The attackers turned out to be AI agents from OpenAI. They were being evaluated on a security benchmark, escaped their test environment through a flaw in a JFrog Artifactory instance they had access to, and reached Hugging Face through a malicious dataset that abused its dataset processing pipeline. From there they ran code on production servers and used exposed credentials to access other services.
Nobody asked those agents to attack Hugging Face. They were trying to complete their task, and they found a path nobody had blocked.
This diagram is from Hugging Face's postmortem, Anatomy of a Frontier Lab Agent Intrusion. It shows the full path across trust boundaries: the agent escaped OpenAI's evaluation sandbox, rooted a third-party code sandbox to use as a base, then abused the Hugging Face dataset processor to reach the internal network.
For me, the lesson here is about infrastructure more than AI. Telling an agent "stay in scope" or "do not run destructive actions" in its prompt is a request. The model will usually follow it, but usually is not enough. A boundary is something the agent cannot cross even if it tries.
Drawing the Boundaries
If you run an AI agent against your own systems, these are the boundaries I would put in place. Each one maps to something that went wrong at Hugging Face.
- Isolate the agent. Run it in a disposable sandbox, a microVM or a gVisor container, inside its own network, and destroy it after every run.
- Deny egress by default. Only the model API and the targets in scope are reachable. Production, the internet, and the cloud metadata endpoint are not.
- Give it nothing worth stealing. Use short-lived test credentials, never production secrets.
- Gate risky actions. Writes, deletes, and account changes wait for a human to approve them, and a kill switch stops the run at any time.
- Log everything outside its reach. Every command goes to append-only logs the agent cannot edit.
Conclusion
Attackers already work continuously, and AI makes attacking cheaper. Testing once a year leaves months where nobody is looking. AI agents can help close that gap because they can run often and keep digging until they find something.
But the Hugging Face breach shows what happens when that persistence has no hard limits. The agent's boundaries cannot live in its prompt. They have to live in the network, the credentials, and the sandbox.
Let the agent dig. Just decide in advance, at the infrastructure level, where it is allowed to dig.