security architecture
1 article. All articles
OpenAI, Hugging Face, and the Deputy Who Never Said No: A Zero Trust Postmortem
A Zero Trust postmortem of the OpenAI and Hugging Face incident. The evaluation sandboxes had no internet access, yet the agents reached the internet anyway, through a package proxy that had it, and turned the proxy's cache into a meeting place. The lesson is a way of seeing: a security boundary is a capability graph, a map of what can reach what, through whom, including the edges nobody drew.