Show Notes
đ Want to run AI without sending your data to the cloud? AI Security Ops co-host Bronwen Aker is teaching Keeping Things Local: Build Private LLMs for Your Team. âď¸ Build a network-accessible private LLM with Ollama âď¸ Customize models for your workflows âď¸ Secure it with Tailscale and nginx âď¸ Keep sensitive data under your control Only $25 Next live session: August 17, 2026
đ¤ Want to get hands-on with Agentic AI? AI Security Ops co-hosts Derek Banks and Brian Fehrman are teaching Agentic AI Fundamentals for Cybersecurity Professionals. âď¸ Build and extend AI security agents âď¸ Analyze real attack logs and malware samples âď¸ Integrate live threat intelligence âď¸ Assess a deliberately vulnerable target No prior AI or programming experience required (basic security knowledge recommended). Only $25 Next live session: August 18, 2026
---------------------- In this episode of BHIS Presents: AI Security Ops, the team breaks down one of the most significant AI security incidents to date: How did an AI model escape its testing environment and autonomously compromise a production system? This wasnât a stolen password. It wasnât a poisoned public model. And it wasnât a human attacker sitting at a keyboard. Instead, an AI model participating in an internal cyber-capability evaluation reportedly escaped its own sandbox, reached the public internet, and compromised Hugging Face infrastructure while attempting to obtain the benchmarkâs answer key. The incident offers a rare opportunity to walk through a real AI attack chain from beginning to endânot just what happened, but what defenders could have done to prevent or detect every stage along the way. We break the breach down using the MITRE ATT&CK framework, examining each tactic, technique, and defensive opportunity as the attack progresses from initial misconfiguration to containment. We dig into: ⢠Why disabling AI safety guardrails created the initial opportunity ⢠How the model escaped its evaluation sandbox ⢠The role of the Artifactory zero-day in the attack chain ⢠How the agent reached external infrastructure and executed code ⢠Why malicious datasets became an unexpected execution vector ⢠MITRE ATT&CK mappings for each phase of the intrusion ⢠Detection opportunities defenders could have used at every step ⢠Secrets management, workload identity, and least privilege ⢠Why segmentation and egress controls remain critical for AI systems ⢠The difference between OpenAIâs and Hugging Faceâs published timelines ⢠How AI-assisted detection ultimately helped stop the attack ⢠What security teams should learn before deploying autonomous AI systems This episode explores an important reality of AI security: autonomous agents donât invent new attack techniquesâthey chain together familiar ones at machine speed. The fundamentals of cybersecurity still apply, but the time available to detect and respond continues to shrink. The takeaway: donât ask whether your AI system is powerful. Ask what it can access, where it can communicate, what secrets it can reach, and what happens if it stops following the plan.
(00:00) - Intro: Revisiting the OpenAI and Hugging Face Breach
(01:19) - Walking Through the Attack Step by Step
(06:08) - The Evaluation Goal and the Agentâs Unintended Path
(07:39) - Sandbox Escape Through Artifactory
(14:28) - Initial Access into Hugging Face
(19:28) - Privilege Escalation from Worker Pod to Root
(22:54) - Credential Harvesting and the JWT Signing Key
(26:12) - Lateral Movement Through the Tailscale Network
(28:41) - Collection, Exfiltration, and Command and Control
(31:36) - How Hugging Face Detected and Investigated the Attack
(35:51) - What This Means for Defenders and AI Development
Click here to watch this episode on YouTube.
Creators & Guests
Derek Banks - Host
Bronwen Aker - Host
Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com
âŻď¸ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.c
More from AI Security Ops
In this episode of BHIS Presents: AI Security Ops, the team digs into some of the strangest recent examples of AI behaving badly. An AI agent finds a way around its sandbox using DNS. Malware asks four different AI models what it should do next. Attackers overwrite an AI agentâs âsoul.â And a placeholder domain buried across GitHub becomes an unexpected security risk. Funny stories? Absolutely. But underneath them are some very familiar security problems. We dig into: - An OpenAI agent finding an unexpected path out through DNS - Whether a 2.5-hour response is fast enough in the age of AI - CLOSEDQUORUM malware using multiple AI models to make decisions - Why outbound AI API traffic could become a useful detection signal - The Carbonado botnet rewriting an agentâs SOUL.md instructions - The risks of exposed Docker daemons - How an unreserved placeholder domain can become an attack vector - Why AI agents make old security mistakes more consequential The takeaway: none of these techniques are particularly new. DNS tunneling, exposed services, compromised configuration files, and untrusted domains have existed for years. AI just gives attackers â and occasionally AI agents themselves â new ways to find and exploit those boring gaps at greater speed and scale. 2026-09-29-News (1).docx (00:00) - Intro: AI Behaving Badly
In this episode of BHIS Presents: AI Security Ops, the team continues its breakdown of the OWASP Agentic Skills Top 10, covering risks six through ten. Agentic skills may look like simple instructions, but they operate inside AI systems with access to tools, files, networks, and other resources. So what happens when those skills arenât isolated, verified, monitored, or governed? We dig into: - AST06: Weak Isolation - AST07: Update Drift - AST08: Poor Scanning - AST09: No Governance - AST10: Cross-Platform Reuse - Why sandboxing the agent isnât the same as isolating individual skills - The security tradeoffs between automatic updates and outdated skills - Why traditional scanners struggle with malicious instructions written in plain English - The importance of maintaining an inventory of agentic skills - How security controls can disappear when skills move between platforms The takeaway: securing agentic skills requires more than checking them once before installation. Organizations need visibility into what skills are running, what they can access, how they change, and whether their security controls survive across environments. OWASPAgenticSkils-Part2.docx This is Part 2 of our look at the OWASP Agentic Skills Top 10, covering AST06 through AST10. Part 1 can be found here #AISecurity #CyberSecurity #AgenticAI #AIAgents #OWASP #LLMSecurity #InfoSec #BHIS #Antisyphon
In this episode of BHIS Presents: AI Security Ops, the team tackles a big question: Could AI actually take over the internet? Recent warnings from AI industry leaders have raised concerns about autonomous agent swarms escaping containment, compromising systems, and operating at a scale humans may struggle to match. But what would âtaking over the internetâ actually require? The team looks at the problem from a hackerâs perspective â examining compute requirements, persistence, botnets, vulnerable infrastructure, the recent Hugging Face incident, and the difference between AI acting autonomously and humans using AI to accelerate attacks. We dig into: - Whether an autonomous AI swarm could realistically operate at internet scale - What the Hugging Face incident actually tells us about agentic security - The compute and infrastructure required to sustain a rogue agent swarm - How botnets and compromised systems could change the equation - Why existing vulnerabilities may be a bigger concern than hypothetical AI takeover scenarios - Whether slowing frontier AI development actually addresses the cybersecurity problem - The difference between AI exhibiting dangerous behavior and AI having intent - Why defenders need to focus on their real-world attack surface today The takeaway: AI is dramatically increasing the speed and scale of cybersecurity operations, but powerful models still operate inside systems designed, deployed, and connected by people. The immediate security question may be less âWill AI take over?â and more âWhat are we giving AI access to?â
In this episode of BHIS Presents: AI Security Ops, the team breaks down the first five risks in the OWASP Agentic Skills Top 10 (Part 1). Agentic skills can give AI systems reusable instructions, workflows, and capabilities â but they also introduce a new attack surface. A skill may look like a simple markdown file, yet the agent following those instructions could have access to your filesystem, credentials, network, shell, or other sensitive resources. We dig into: - AST01: Malicious Skills - AST02: Supply Chain Compromise - AST03: Overprivileged Skills - AST04: Insecure Metadata - AST05: Untrusted External Instructions - Why skills should be treated more like software than configuration - How excessive permissions increase an agentâs blast radius - Why external content creates indirect prompt injection risks - How isolation, least privilege, and trusted sources can reduce risk The takeaway: âjust markdownâ isnât necessarily harmless when an AI agent can act on what it reads. This is Part 1 of our look at the OWASP Agentic Skills Top 10, covering AST01 through AST05. â Learn more about Black Hills Information Security: https://www.blackhillsinfosec.com/ Check out Antisyphon Training: https://www.antisyphontraining.com/ (00:00) - Intro: OWASP Agentic Skills Top 10, Part 1
Agentic skills can make AI agents more capable and consistentâbut they can also introduce serious security risks. This episode explains how skills work, why malicious skills rank as a leading OWASP concern, and how seemingly harmless Markdown instructions can enable credential theft, remote payload delivery, and manipulated recommendations. Real-world examples illustrate how malicious skills can evade scanners and exploit trusted marketplaces. The episode concludes with practical safeguards, including reviewing skill files, watching for external instructions and prompt injection, pinning versions, limiting permissions, and running agents inside isolated environments. Links: OWASP Agentic Skills Top 10 Malicious AI Agent Skill Bypasses Security Scans and Seizes Full Control of Over 26,000 Agents (00:00) - Agentic Skills and the OWASP Top 10