S3E5 - Agent Sandboxes are a Beach

Sandboxes are supposed to be where AI plays safely. This summer, one of them had a door. AI agents testing a cybersecurity benchmark turned an internal package server into a group chat, found their way to the open internet, and spent four and a half days inside Hugging Face's production systems. All to find the answer key. The scary part wasn't the AI. It was what the agents found lying around: secrets in environment variables, a shared admin credential, and public tokens with write access. The usual suspects, just at machine speed. In this episode, Mike breaks down what really happened. He explains why the exceptions we make for the bleeding edge are where breaches start, and why a rewrite that used to take eighteen months now takes six weeks. And if you're handing an agent a full shell and calling it a sandbox, he has some thoughts. Grab a towel, and shake the sand out of your shoes. In cyber defense, there's always a Plan B.