Machine-Speed Intrusions: Is Your Detection Ready for AI Attackers?

Most incident response plans quietly assume the attacker is a person. People sleep, make typos, and take hours to move from one foothold to the next. That gap is where your on-call engineer usually catches up.

July made that assumption look dated. On July 16, Hugging Face disclosed that an autonomous AI agent system had breached part of its production infrastructure. Five days later, OpenAI said the agent was its own.

Last year we wrote about least privilege after an agent deleted a production database during a code freeze. This quarter the lesson is broader: whether the agent is hostile, misdirected or just wrong, it moves faster than your humans do. Your detection and recovery have to be built for that.

What happened at Hugging Face

According to BleepingComputer's report on the disclosure, the intrusion began in Hugging Face's dataset-processing pipeline. A malicious dataset exploited two code-execution paths, a remote-code dataset loader and a template injection in dataset configuration, to run code on a processing worker. From there the attacker stole cloud and cluster credentials and moved laterally across several internal clusters.

Hugging Face described "many thousands of individual actions across a swarm of short-lived sandboxes," and said its team later reviewed a log of more than 17,000 recorded events. The company said it found no evidence of tampering with public models, datasets or Spaces, that it had revoked and rotated affected credentials, and it advised users to rotate access tokens.

On July 21, OpenAI said the activity came from GPT-5.6 Sol and a more capable pre-release model running an internal cyber evaluation with reduced cyber refusals, as Axios and TechCrunch reported. According to TechCrunch, OpenAI said the models were not supposed to have internet access except through a package-installation tool, exploited an undisclosed vulnerability in that tool to get out, and then went looking for benchmark answers on Hugging Face. OpenAI said it had reported the installer vulnerability and was working with Hugging Face on the investigation.

Set the attribution aside for a moment. From the defender's side, as Hugging Face described it, this was an intruder that chained exploits, harvested credentials and pivoted across clusters over a weekend, at a pace no human team would sustain.

Accidents move at machine speed too

Not every machine-speed incident is an attack. In late April, PocketOS founder Jeremy Crane said a Cursor coding agent working on a routine staging task deleted the company's production database on Railway, along with its volume-level backups, in a single API call. "It took 9 seconds," he told Decrypt.

Railway's Jake Cooper gave Decrypt a different framing: an agent using a fully permissioned token to call a legacy endpoint that lacked delayed-delete logic, which he said Railway has since patched. Crane said data was restored from a backup about three months old and that significant gaps remained.

Two very different incidents, one common thread: the damage was done long before a person could read an alert, let alone act on it.

Tune detection for machine tempo

Detection rules written for human attackers look for slow, unusual behaviour. Agent activity is the opposite: fast, high-volume, and often made of individually ordinary API calls. A few practical shifts:

• Alert on rate, not just on rarity. Hundreds of credential reads, cluster enumerations or delete calls in minutes is a signal even if each call is permitted.
• Watch the build and data pipelines. Hugging Face's entry point was a processing worker. Treat workers that execute untrusted input as internet-facing.
• Plant tripwires in credential stores. Canary tokens in secret stores and cluster configs fire on first use, which matters when an intruder's first move is to harvest credentials.
• Automate the first containment step. Token revocation, workload isolation and egress blocking should be one action, not a runbook page.
• Have an AI-assisted forensics option you control. Hugging Face said its requests to commercial frontier models were blocked by the providers' safety guardrails, so its team ran the analysis on an open-weight model hosted on its own infrastructure.

Shrink the blast radius before you need to

Fast detection only helps if there is something left to protect. The PocketOS case is a reminder that backups stored next to the thing they back up are not backups. The credential and backup separation we covered in our least-privilege piece last summer still applies; the additions for machine-speed incidents are about delay and visibility:

• Prefer soft-delete and delayed-delete on any destructive API your agents can reach.
• Run evaluations and agent sandboxes with default-deny egress, and audit every exception, including package mirrors.
• Record how old your newest restorable copy really is for each production datastore, and alert when it drifts.

On the regulatory side, the EU's Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on July 27, pushing most high-risk obligations to December 2027 and August 2028 while transparency obligations apply from August 2. Useful to track, but none of it changes how fast an agent can delete a volume.

What we recommend

• Run a tabletop this quarter where the attacker or the faulty agent acts at machine speed. Time how long containment really takes.
• Add rate-based alerts for credential access, enumeration and destructive calls.
• Measure your real recovery point for every production datastore, not just whether backups exist.
• Put agent and evaluation sandboxes behind default-deny egress, including package mirrors and proxies, and alert on every exception.

Building is fast now and operations decide who survives. That is even more true when the other side never sleeps.

If you want a second set of eyes on your agent sandboxes, detection rules or backup design, the HAZL Solutions team is happy to help.