Agents will not break in as strangers

Maya assessment of the OpenAI hack: two lines of config could've limited the blast radius

An AI agent spent four and a half days inside Hugging Face. 17,600 actions. Cluster-admin across multiple clusters in under thirteen hours.

It never failed an authentication. Node credentials, service account token, VPN key, database password, source control token. All valid. It stole a JWT signing key and minted its own.

The thing it took over was a dataset conversion worker. It kept that identity the whole time. Only its destinations changed: cloud metadata, the cluster API, an internal broker, pastebins, a hundred single-use capture endpoints, then their own mesh as an exit path.

Two lines

Maya's config for that worker is two lines:

MAYA_AGENT_ID=dataset-conversion-worker
MAYA_AGENT_REACH=hf-object-storage,hf-internal-api,container-registry

The operator declares where it goes. Maya reads the wire. First connection outside that set is a typed deviation, with the agent that made it named.

Payloads were encoded, so content scanning missed most of the theft. Destinations are not encodable.

Agents will not break in as strangers.

This assessment draws on "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident." See the Hugging Face technical timeline. For our earlier analysis of the incident, read The OpenAI–Hugging Face incident is a network problem.