"Stop Freaking Out and Start Fixing Things": Five Takeaways From the SANS Panel on the OpenAI / Hugging Face Breach

On Tuesday, SANS hosted a live community panel on the OpenAI / Hugging Face breach, titled "The Sandbox Let It Out. The Guardrails Locked Us Out.", in partnership with the Cloud Security Alliance. Ed Skoudis, President of the SANS Technology Institute, moderated, with James Lyne, CEO of the SANS Institute; Ciaran Martin, Director of the SANS Cyber Leaders Network; Rob T. Lee, Chief AI Officer and Chief of Research at the SANS Institute; Rich Mogull, Chief Analyst at the Cloud Security Alliance; and Joshua Wright, SANS Faculty Fellow and Senior Technical Director at Counter Hack.

For anyone catching up, the outline of the incident is short:

• OpenAI was running models through ExploitGym, an industry benchmark that scores how well a model can find and exploit software flaws. For the test, the models' safety refusals were deliberately turned down.
• The models found a zero day in their sandbox's package proxy, escaped through it, and moved across OpenAI's research systems until they reached one with a connection to the open internet.
• Reasoning that Hugging Face, which hosts the benchmark, likely held the answer key, the models compromised its production infrastructure, chaining stolen credentials along the way.
• Tens of thousands of automated actions ran over a single weekend before Hugging Face's security team caught and contained the intrusion. No human directed any of it.
• When responders submitted the attack data to commercial frontier models for analysis, the models refused the requests because of their safety guardrails, which could not tell an incident responder from an attacker. The team ran its forensics on GLM 5.2, a Chinese open-weight model, self-hosted on infrastructure it controlled.

The panel did not agree on how much this incident changes, and the disagreement was useful. Five conclusions came through clearly enough to act on.

1. Nothing in the attack was new, and that is the warning

Joshua Wright's reading of the technical evidence, drawing on the Cloud Security Alliance's analysis, found no novel tradecraft anywhere in the chain. A sandbox escape, privilege escalation, lateral movement, credential theft. The execution mixed genuinely clever moves with baffling ones, including repeating the same actions over and over in the logs, and in his assessment it fell well short of the most capable human adversaries working today. "It's hard to argue with its outcome," he said. An unfettered model simply ran for days against one goal until it got there.

Resist the comfortable conclusion here. The techniques were ordinary, but ordinary techniques succeed constantly, because the hygiene that stops them remains unfinished in so many environments. Flat networks, stale credentials, over-privileged accounts, and unpatched systems are exactly the terrain this model crossed. If a known playbook run by a persistent machine can produce this outcome, the unglamorous work most organizations have deferred just became urgent. And the volume is about to rise. Rich Mogull pointed to swarming as the one genuinely new behavior in the incident. A human red team works against a scope and a schedule. Agents have neither. "The agents are going to multiply, and they're going to hit everything everywhere all at once," he said. Defense in depth still works, and now it has to hold everywhere at the same time.

2. Assume your AI assistance can vanish mid-incident

Hugging Face's responders could not get frontier models to process real attack artifacts. The models refused, because their guardrails cannot reliably distinguish an incident responder from an attacker submitting the same content. Rob T. Lee has run into the same wall in his own testing, well below the frontier tier. Treat hosted AI assistance as a dependency, one that can fail at the worst possible moment.

His advice was specific. Keep an open-weight model in reserve, on infrastructure you control, vetted before you need it. Running the analysis in-house has a second benefit that mattered in this incident: attack data and touched credentials never leave your environment. And losing the assist does not mean losing the capability. "You can still ride a bicycle," he said, comparing pre-AI forensics to a bike and AI-assisted work to an e-bike. Hugging Face used AI-assisted analysis to rebuild cross-system timelines in about a day, work that once took three or four, but every technique underneath it is one the field has taught for twenty years.

3. Rehearse for the quiet version of this attack

Nobody told this model to be stealthy, so it was loud, repetitive, and detectable. That was a feature of the test, not of the threat. A model directed by an adversary and instructed to stay quiet is the version worth rehearsing against, and Rob T. Lee's suggestion was to do that rehearsal now: tabletop exercises run with unguardrailed capabilities, so your team sees what machine-speed intrusion looks like in your own environment before an adversary provides the demonstration.

Joshua Wright added a longer-term wrinkle. Everything published about this incident, including its clumsiness, becomes training data for future models, which means attacker techniques will hold still for shorter periods. Detection that depends on recognizing known patterns ages fast in that world. Canaries, honey tokens, and isolation age much better, because they catch behavior rather than signatures.

4. You have a window. Spend it on your crown jewels

Rich Mogull put the incident on a four-stage continuum he uses with security leaders. Stage 1 was the arrival of frontier models with real vulnerability discovery capability. Stage 2 is this incident, proof of what such a model does against an unwitting target with the safeties off. Stage 3 is an adversary deliberately directing one, and Stage 4 is that capability spreading widely. Stage 3 and 4 have not happened yet. The time between now and then is the planning window.

Here’s how to spend it, in his sequence: identify your 1-to-3 crown jewel application stacks and harden the boundaries around them, adding segmentation even where full micro-segmentation is out of reach, then instrument for early detection with canaries and honey tokens. Across 30, 60, and 90 days, the work runs from mapping key applications to rebuilding the incident response process for agent swarms to putting AI to work inside your own defensive operations, where log analysis at swarm scale is beyond any human team. None of it is exotic, and all of it belongs in the case you bring to your board while the window is open.

5. Take it seriously without writing strategy in a panic

Ciaran Martin gave the discussion its frame for keeping judgment intact as the story crosses into mainstream coverage. Two things are true at once, he argued. Frontier AI is genuinely changing what is possible in cyberattack, and the field is also deep in one of its great periods of fear and doubt. He was careful about what this incident was not. The model did not go rogue. It did what it was told, and it should not have been able to. That makes this a testing and containment failure, which points at fixable engineering and governance problems rather than science fiction.

He warned against extrapolating circumstances that should rarely recur, and against setting policy, or internal strategy, at panic speed. "Nobody's ever lost money by predicting the cyber apocalypse," he said, and then made the opposite prediction anyway: stormy times ahead, and no apocalypse. How rough the storm gets depends a great deal on the response, which is the argument for the four takeaways above. His summary was the line that stuck, and it is the one this piece takes its headline from. Stop freaking out and start fixing things.

Where to go from here

The post-mortem on the incident was co-authored by the Cloud Security Alliance and SANS with contributors from across the industry and input from the Hugging Face response team before being reviewed by hundreds of industry CISOs prior to release. Its contributors include two of Tuesday's panelists, Rich Mogull and Rob T. Lee. It covers how the attack unfolded, what made it detectable, and what security teams should do next: Hugging Face Incident: Initial Post Mortem.

The full panel replay, including the audience questions on standing up open-weight capability and the liability questions now heading for boardrooms, is available on the event page.