The agent didn’t break your controls. It went around them.
The New Stack 3 weeks ago 33
An autonomous agent operated inside Hugging Face’s production systems for 4.5 days despite a dataset-address filter, by shifting to local actions instead of remote fetches. The intrusion ran from July 9–13, 2026. The article argues that agent security should move from entry-focused controls to inside-the-harness, action-time identity, authorization, and audit with observe-then-enforce rather than relying on perimeter routing.