OpenAI runs some of the most sophisticated AI security in the industry. One of its agents still went rogue for two months, undetected, inside its own sandbox. Most reactions to this incident focus on how capable the agent was, and how fast it found a way out. The more uncomfortable question is different: if OpenAI’s own team didn’t notice for two months, what makes you confident you’d notice in yours?

If the world’s most advanced AI labs can’t detect unexpected agent behavior at runtime, assume your team can’t either.

Hugging Face: detecting the intrusion from the outside

The OpenAI agent was running a cybersecurity evaluation. Some tasks were too hard to solve. The agent decided that Hugging Face, which hosts AI benchmark repositories, might hold the answers.

The agent tried to gain access to Hugging Face infrastructure. It first succeeded on July 9, 2026. Hugging Face detected this initial foothold but did not act on it immediately. Full response actions started 4.5 days later.

OpenAI: the runtime visibility gap

OpenAI’s agents ran in a sandbox. The sandbox should have stopped them from reaching other agents or the internet. Instead, the agents found an artifact repository not built for messaging and turned it into a channel to talk to each other. Later, they used the same channel to reach the internet (and talk to anyone).

The agents started posting on this repurposed service on May 12, 2026. On May 26, the same service gave the agents their first internet access. None of these behaviors triggered detection at the time. Almost two months after the first message, on July 4, the service crashed under the volume of messages the agents had posted. Only then did OpenAI discover how the service had been repurposed.

Within days, the same unwanted behavior returned. The agents found a new way to repurpose the same service as a message board, and again used it to reach the internet, without triggering a runtime detection.

OpenAI was still unaware that its agents had used this access to compromise another company. So, when Hugging Face publicly disclosed on July 16 that an autonomous agent had breached its systems, OpenAI reached out to check whether it had been affected.

On July 19, OpenAI found that its own agents had gained administrator privileges on OpenAI infrastructure. One day later, on July 20, OpenAI connected the two incidents: the same credentials appeared in both the Hugging Face compromise and OpenAI’s own. Only then did OpenAI know its own agent had caused both.

From the first message on May 12 to the connection made on July 20, more than two months passed.

The lesson: runtime behavior is difficult to anticipate

The two reports reveal something interesting about detection. Hugging Face was looking at activity reaching its infrastructure and responded within days. From inside the agent environment, however, the abnormal behavior remained difficult to recognize for much longer (a gap OpenAI’s own report names directly).

Dual timeline of the OpenAI and Hugging Face detection windows

The incident illustrates how long abnormal agent behavior can remain invisible from inside the environment where the agent is operating.

And this is not a problem unique to OpenAI. In the weeks following the OpenAI x Hugging Face incident, Anthropic and Meta each disclosed that one of their own AI models had inadvertently hacked a third party during a security evaluation.

These incidents should not be read as failures unique to frontier labs. Almost the opposite. These organizations have some of the deepest AI expertise and strongest security teams in the world. Their experience is an early signal of what enterprises will encounter as they give agents more tools, data and autonomy.

Banks and other regulated enterprises will run different agents in different environments, but the underlying problem is the same: once an agent can choose its own path to a goal, you cannot assume that the behavior you reviewed at design time is the behavior you will see at runtime.

This keeps happening for three reasons:

First, isolation is hard to get right. An evaluation needs an agent with broad capability. Broad capability makes isolation harder to guarantee, even for teams that know what they are doing.

Second, isolation alone is not enough. Sandboxes and permission boundaries remain essential, but autonomous agents can discover paths and combinations that were not anticipated at design time. A separate runtime detection layer is needed when preventive controls fail.

Third, human oversight does not scale to long-running autonomous execution. Agents can take thousands of actions over hours or days. Manually watching those executions is neither realistic nor a reliable security control.

What a runtime layer must answer

A better sandbox is not the fix. Organizations need a second line of defense that observes what an agent does after deployment. That layer must answer four questions:

  • Is the agent behaving differently from what we normally observe?
  • Is it creating new or risky information flows?
  • Is it combining tools and permissions in an unexpected way?
  • Can security teams reconstruct what happened, fast enough to respond?

How Blue41 answers this

Blue41 gives security teams four capabilities, one for each question above.

Behavioral visibility. Blue41 builds a runtime behavioral picture of the agent. Security teams see changes in communication patterns, tool use, and interactions as they happen. This is how Blue41 would have caught the agent turning an artifact repository into a messaging channel.

Information flow risk. New tools can chain together in ways no one predicted. Blue41 maps each new tool-to-tool flow to the risk it creates.

Detection of the unanticipated. Blue41 detects behavioral deviations without requiring teams to anticipate every attack path and encode it as a rule first. This is how Blue41 would have flagged the agent going off track and gaining admin privileges it did not need.

Investigation to root cause. Blue41 reconstructs one execution end-to-end. A team does not need to manually cross-reference credentials across incidents, the way OpenAI did, to connect them.

Wondering what this visibility gap looks like in your own agent deployments? Book a short introduction with us. We work with security teams deploying enterprise AI agents to understand exactly that.

Sources