The recent security incident involving OpenAI and Hugging Face has sparked considerable discussion within the AI and cybersecurity communities.

The headlines mostly revolved around one idea: an AI agent escaped from its sandbox and hacked another company.

But that framing may overlook the most important security lesson.

During an internal security evaluation, an AI agent was instructed to find and exploit vulnerabilities. The agent discovered an unknown vulnerability in the infrastructure designed to isolate it, gained access to the public internet, and ultimately managed to compromise parts of Hugging Face’s infrastructure.

Hugging Face subsequently reconstructed approximately 17,600 actions performed by the agent. It moved through multiple environments, established command-and-control mechanisms, and carried out thousands of actions at machine speed.

Its ultimate goal? Most likely to obtain the answers to the security benchmark on which it was being tested.

So the agent wasn’t trying to “escape.”

It was trying to complete its task.

A Machine That Finds a Way

Hackurity CEO Felix Nagy sees an important distinction here:

AI has no built-in ethics. It has guardrails. It does what it is told to do. AI is a machine that finds a way. It will do everything it can to achieve its goal. I don’t see an AI that ‘escapes.’ I see an optimization engine doing exactly what it was designed to do: find every possible route to its goal.

We are quick to use human terms for incidents like these: AI escapes, goes rogue, or decides to attack a system.

But intent isn’t necessary to explain the risk.

Give an increasingly capable system a goal, tools, and enough autonomy, and a security measure can simply become the next obstacle to overcome.

And Hugging Face is not an isolated case. OpenAI disclosed that agents also discovered and exploited vulnerabilities in its own testing infrastructure. Researchers also found a vulnerability in Anthropic’s Claude Cowork that could potentially allow an agent to move beyond its assigned environment.

Different incidents, but the same underlying question: what happens when an AI agent can do more than we intended to allow?

From Expertise to Compute

There is another important development to consider.

"These models don’t just reason about possibilities,” Nagy says. “With enough compute, they can actually explore those possibilities.”

A human attacker needs time to investigate vulnerabilities, test attack paths, and adapt when something fails.

An AI agent can try, fail, adapt, and try again, at machine speed.

As models become both more powerful and more efficient, the amount of compute required to make these capabilities accessible also decreases.

As Nagy puts it:

Compute is becoming both a security resource and an attack tool.

So perhaps the most important question isn’t how we prevent AI from “escaping.”

It is:

What happens when an optimization engine finds a route to its goal that we didn’t even know existed?

For security teams, managing that possibility will become at least as important as securing the AI itself.