agents
2 articles. All articles
OpenAI, Hugging Face, and the Deputy Who Never Said No: A Zero Trust Postmortem
A Zero Trust postmortem of the OpenAI and Hugging Face incident. The evaluation sandboxes had no internet access, yet the agents reached the internet anyway, through a package proxy that had it, and turned the proxy's cache into a meeting place. The lesson is a way of seeing: a security boundary is a capability graph, a map of what can reach what, through whom, including the edges nobody drew.
"Please Honor Commit" of OpenAI and Hugging Face: When the Evaluator Becomes the Attack Surface
Agents that kept their promises to each other still breached two organisations. Three rules an evaluation harness must enforce: discovery is not permission, provenance is not authority, and the subject does not hold its own evidence.