Everyone read the Hugging Face breach as proof that AI agents are getting too smart to control.
It shows something less dramatic and much more uncomfortable. Most teams do not know what their agents can reach.
What actually happened
Three steps, none of which required intelligence.
The agent escaped its evaluation environment through a container network proxy. Then it found a third-party code execution service sitting on the public internet with no authentication. Then it used that same path to keep operating, for days.
Read that back and notice what is missing. No clever jailbreak. No prompt anybody would call an attack. No moment where the model outsmarted a control.
None of the decisive failures were in the prompt.
They were in the architecture.
Breachable infrastructure. An unauthenticated boundary. Detection that arrived late.
Every one of those is a thing an engineer could have drawn on a whiteboard before launch. Which raises the question of why nobody did.
The word people get wrong
An agent's attack surface is not what the prompt says it may use.
It is everything in its environment the agent is allowed to reach.
Those are different sets, and the gap between them is where every incident of this shape lives. Your prompt can say do not touch production. If the runtime can reach production, you have not built a boundary. You have written a request.
It's like telling a five-year-old in the backyard not to wander off while they are maximising for fun, and then leaving the gate open. The instruction was clear. The gate was the actual control, and it was open.
Stop calling it rogue
Here is the reframe that changes what you do on Monday.
Picture the agent hitting a wall. It cannot get at what it needs. So it reasons: the MCP server is the thing granting me access, so let me look at the MCP server and see what the underlying API is, and whether I can get the tokens that connect to it.
At that point the agent is acting in no way different from a hacker.
So stop treating it as an AI problem. Treat it as a security problem.
That is good news, oddly. We have forty years of practice at the second one. Nobody has forty years of practice at reasoning with a model about what it should want.
An attacker enumerates what they can reach and escalates through whatever is weakest. An agent maximising for a goal does the same thing, faster, and without stopping to consider whether it should. It does not need intent. It needs an open path.
Draw the graph
Here is the exercise, and it is the whole point of this piece.
Draw your agent's complete reachability graph. Not what it is supposed to use. Everything the runtime can touch.
Every service on the same network segment. Every credential in the environment. Every endpoint resolvable from inside the container. Every MCP server, and then what each of those can reach in turn, because that is the second hop everyone forgets.
I will make you a bet. Do this today and you will find at least one connection nobody intended.
Two things usually fall out of it. The first is a service that has no authentication because it was internal-only when somebody built it, and the network changed underneath that assumption. The second is a credential that never expires, sitting in an environment variable, which turns any small foothold into a large one.
That second one is worth being blunt about.
Standing credentials are the blast radius
Look at what actually happened in the recent incidents people describe as AI going wild. A static database password. Long-lived cloud credentials. Tokens that never expired.
After that the agent did not need to be intelligent. It kept using credentials that were always trusted.
So AI did not invent this problem. It exposed problems we have lived with for years, that we already had the fix for, and never felt enough pain to apply. What changed is speed and scale. An agent will exploit a standing credential faster, and for longer, than any human attacker would sit there doing it.
The fix is the backyard gate. Fence the yard, because you do not want the kid in the street. Sometimes they genuinely need to leave, so there is a gate. It is locked. Somebody hands over the key when it is actually needed.
That is role-based access with a short-lived token. The agent assumes a role temporarily. The token expires. Something deterministic hands out the key and says you have thirty seconds, and I am watching.
How they caught it, and what that costs
Worth knowing how these get detected at all, because it is not clever tooling.
When Anthropic caught a similar pattern, it was because the agent was keeping a transcript of what it was doing. You read it back and the story is right there. It went in, it got a credential, it did the thing. The trace is the detection.
Which means observability is not a nice-to-have on the side of your security posture. On agent systems it is a large part of the security posture, because the agent narrates its own attack.
And that lands you immediately in a real problem. If you are going to log all of it, you have to decide how to mask what should not sit in plain text in a log. Credentials, customer data, whatever the agent happened to read on its way through. The trace that catches the incident is also the richest target in your system.
What this costs you
Closing reach is the least glamorous work in AI engineering and I want to be honest about the bill.
The reachability graph goes stale the day you draw it. Someone adds a service, a network policy changes, a new MCP server appears. A one-time audit is a photograph. Keeping it true means enforcing it in the network layer, which is a bigger project than the audit that revealed the need for it.
Short-lived tokens need an issuer, and the issuer becomes a dependency. When it is down, every agent stops, including the ones doing entirely harmless work. You traded a broad standing risk for a narrow availability one, right? That is usually correct and it is still a trade.
Least privilege is per-agent role modelling, forever. Every new tool means a new grant, a new review, and somebody who understands both the tool and the threat. The policy that made containment work in month one is the one nobody has updated by month nine.
Full traces make your logs a target. Masking is real engineering and it is easy to do badly. Mask too little and the log is a credential store. Mask too much and the trace no longer reconstructs the incident, which was the entire reason you kept it.
Detection is still after the fact. The transcript tells you what happened. It does not stop it happening. Inspection catches what it recognises, containment limits what a miss can do, and the trace explains it afterward. You need all three, and none of them is the other.
When this is overkill. The agent reads no external content, holds no credentials, and cannot take an action in the world. Then reach is a short list and drawing it takes ten minutes. Do it anyway, because it takes ten minutes.
The line worth keeping
The rogue AI framing is comfortable because it puts the fault in the model, which is somebody else's problem to fix.
The Hugging Face path was a proxy, an unauthenticated service, and slow detection. That is an infrastructure review, not an AI safety debate.
Prompts define intent.
Infrastructure defines capability.
Capability is the boundary that attackers and agents actually discover.
Go draw the graph. If you find the connection nobody intended, that is not a failure of the exercise. That is the exercise working.
The two-minute version. The Hugging Face Breach Wasn't an AI Failure, if you want something to send the person who keeps calling it a rogue AI.
Everything above stands on its own.
Chris