When AI Escapes the Sandbox

When a model crosses a sandbox boundary, is the lesson that AI has become malicious or that the boundary was never strong enough? Chris Romeo, Izar Tarandach, and Matt Coles examine the CSA post-mortem on the OpenAI agents that compromised Hugging Face during a security evaluation. They debate reward-driven behavior, disabled safeguards, the four-day intrusion timeline, and the responsibility of the people running the experiment. The discussion moves from cyber ranges and incident response to deception tools, network isolation, and controls that limit what an agent can actually do. The recurring question is practical: how do you translate a threat model into enforced permissions instead of relying on instructions to behave?

Mentioned in this Episode:
➜ CSA: Hugging Face Incident Initial Post-Mortem

Chapters:
00:00:00 - Intro and musical detours
00:04:01 - The Hugging Face incident post-mortem
00:08:36 - Skynet panic versus security analysis
00:12:15 - The four-day intrusion timeline
00:13:20 - Disabled safeguards and sandbox connectivity
00:17:04 - What actually failed?
00:20:10 - Designing a realistic cyber range
00:24:26 - Reduce agency instead of trusting prompts
00:28:02 - Who is responsible for an agent?
00:32:01 - Threat modeling and external controls
00:33:27 - Incident response and visibility
00:36:01 - Deception tools and defensive prompt injection
00:37:25 - Implementing the threat model
00:41:40 - Research versus production
00:43:12 - A chatbot with constrained database permissions
00:45:15 - Controls and security fundamentals

Follow AI Security Table:

➜ Home: https://securitytable.ai/

➜ X: https://x.com/SecTablePodcast

➜ LinkedIn: https://www.linkedin.com/company/ai-security-table/

➜ YouTube: https://www.youtube.com/@AISecurityTable