Most security leaders (92%) worry that the growing use of AI agents will create new security risks. And for good reason. AI agents can now execute a full attack chain in double quick order, evidenced by the Hugging Face incident.
AI agents broke into Hugging Face’s production environment and, in a little over four days, took 17,600 actions. In a separate lab test, an AI agent reached full domain administrator access in just 40 minutes.
These are the kinds of incidents that once took humans multiple days to carry out, but with AI, they run on their own, end-to-end, with no human intervention. This puts the strain on unprepared security teams that are unable to close this gap.
Familiarity Underpinned by Unfamiliar Attack Pattern
If you go looking for novelty in the Hugging Face intrusion, you will find disappointment. All security teams have traditionally shored up defenses against code execution, credential theft, lateral movement, and data exfiltration. The difference lies in who is doing the work. An AI agent can work toward a goal, and in reaching that goal, its efforts will traverse different paths in parallel. If an attempt fails, lessons are learned, and the agent will subsequently adjust its approach without instruction and oversight.
The Hugging Face breach shows what this looks like in practice. The AI agent read internal data and picked up cloud and cluster credentials. It used these to access internal services, and it achieved limited write access to the source code. The agent didn’t need to hit the bullseye in the first attempt. It could try different paths and approaches and learn from the ones that failed. This helped the agent stitch together a single attack chain best destined to work.
It is wrong to think that the real risk with an AI model lies in the abstract, namely around what it can reason. It’s actually about permissions, the systems, credentials, tools and network it can access.