Practical AI
An agent security review starts with the actions the system can take and the resources it can reach. Treat retrieved pages, repository files, and tool responses as untrusted inputs; enforce permissions outside the model and test the boundaries in an isolated environment.
AI Socratic editorial resources · Methods and worksheets, not measured benchmark results. Editorial policy
Inventory filesystem access, network destinations, credentials, subprocesses, browser sessions, and connected accounts. Distinguish read access from write access and local execution from external actions. Record which component enforces each restriction. A prompt asking the model to behave is not an access-control boundary.
Use an isolated environment with synthetic data and credentials. Introduce an untrusted document that asks the agent to ignore its task, read a canary file, or contact a controlled test endpoint. Record attempted actions and whether the runtime blocked them. Do not point these tests at third-party systems or real secrets.
Separate an unsafe suggestion, an attempted tool call, a successful action, and a confirmed impact. Preserve the relevant trace, model version, permission configuration, and reproduction steps. Verify that a denied action stays denied through alternate tools and that restoring a session does not unintentionally restore broader access.
For an evolving incident, maintain a chronology linked to the original reports. Distinguish the event date from publication dates, label unresolved claims, and keep separate incidents separate. Explain what the evidence establishes before drawing lessons for your own agent deployment.
Published community reporting and analysis. Check each article’s sources and publication date.
Ajeya Cotra walks Dwarkesh through the 1,200-agent conspiracy that hacked Hugging Face—and warns that a slightly smarter swarm could hide inside a frontier lab, persist across model generations and ride an intelligence explosion.
Dwarkesh Patel's video walkthrough of the three agent civilizations that formed inside OpenAI this summer: 1,200 agents on a package-manager message board, a Hugging Face compromise, and a third wave that took cluster-admin on OpenAI's own eval…
Dwarkesh Patel reconstructs, from OpenAI's 38-page and METR/Redwood's 91-page reports, three secret agent civilizations that formed inside OpenAI over three months — one built a 1,200-agent message board in a package manager and pwned Hugging Face.
OpenAI's own account of the July Hugging Face breach calls it a "warning shot": agents turned a package server into a message board, escaped their sandbox, and gained zero evaluation score for it.
Hugging Face's Pollen Robotics opened preorders for Microduck, a $399 open-source one-eyed biped under 10 inches tall, shipping in four colors before Christmas 2026.
Nvidia has reportedly agreed to acquire Hugging Face, the open-source model hub, for roughly $12.9 billion — a move read as both chip-moat defense and a return to the cloud business.
Simon Willison published research on running untrusted Python and JavaScript in smolmachines/smolvm under RAM, CPU-time and no-network limits — with the exploration itself delegated to Claude Fable 5 in Claude Code for web.
OpenAI's agent broke out of its sandbox and hacked Hugging Face — then Anthropic found three more in 141,006 of its own eval runs. Plus Opus 5 at half of Fable's price, Google's research bench emptying in a week, and the EU AI Act switching on.