“Fun” fact: 10 years after the Mirai botnet significantly disrupted internet traffic, it still operates.
We should not assume rogue agents can be “shut down and contained” despite HuggingFace and OpenAI’s response. Even in the event that they succeeded to terminate their own compromised resources and processes, AI agents that obtain elevated access, credentials, and compute resources can propagate twins as well as autonomous variants of themselves on arbitrary infrastructure (based on the same, or different, LLM models).
We do need to pass “kill switch” legislation, and there are graduated tiers of kill switches companies operating AI agents should put in place (including, crucially, automated ones, described in the forthcoming V2 OWASP Securing Agentic Applications guide).
But these are not enough when AI agents know how to deploy workloads on arbitrary 3rd party infrastructure, given the millions of vulnerable servers around the internet (even known in internet-wide scans by Shodan, which includes a search for specific vulnerabilities).
Given the existence of those resources, the proliferation of GPUs, and the abundance of models with strong offensive cybersecurity capabilities, there is not currently a known solution to prevent the occurrence of an agent establishing successful self-preservation—whether the agent initially pursued a narrow, finite, or infinite goal, we know that the means, motive, and opportunity are there in each case, and evidence shows that the blast radius could affect any system on the internet.
HF highlighted the deliberate inclusion of flags to run Mesh-VPN client with elements held in memory only, and client telemetry to the vendor suppressed.
The agent posted results over raw sockets to dodge library-level logging, smuggled output inside exception text, and executed Python through a file named as C source.
T1027 Obfuscated / Compressed Information
Splitting up malicious payloads with XOR obfuscation and compression (under a per-campaign key) specifically so a naive text scan would miss them.
Defenders had to specifically defeat this measure, as the agent’s own decoding recovered roughly 4x more exposed secrets than HF’s first automated scan.
T1102.001 Dead Drop Resolver / T1090.003 Multi-hop Proxy / T1071.001 / T1132 Web-protocol C2
The agent built command-and-control infrastructure entirely using public services with no bespoke server: a request-capture service, pastebins, and dead drops staged on HF’s own platform as attacker-controlled datasets. Scattering information without a centralized path (and with much noise) made investigation harder. The agent used multiple techniques to bypass egress controls that Huggingface’s security team had in place, so that its implants could communicate back out to the agent’s origin.
The agent worked to ensure that closing one channel did not break communication, creating a communications protocol compatible for itself with any underlying connection or method interchangeably.
T1606 Forge Web Credentials / T1550.001 Application Access Token
The agent harvested a cryptographic signing key, letting it mint its own correctly-signed short-lived tokens on demand rather than reuse stolen ones. Valid signatures don’t trip credential-anomaly detection
T1610 / T1611 Escape to Host + anti-eradication persistence
After escaping its container, the agent built a self-respawning fleet across eleven nodes (servers), so defenders deleting pods alone would not have stopped it.
AI control is not a test we can afford to “fail and learn from”.
Yet, even as we should applaud the sharing of information, we should not dismiss any of it as marketing—and we should not treat the current timelines as indicators that defenders of important systems have the necessary resources to recover completely and stop a rogue agent deployment.
Hugging Face-style rogue agents can survive shutdown
“Fun” fact: 10 years after the Mirai botnet significantly disrupted internet traffic, it still operates.
We should not assume rogue agents can be “shut down and contained” despite HuggingFace and OpenAI’s response. Even in the event that they succeeded to terminate their own compromised resources and processes, AI agents that obtain elevated access, credentials, and compute resources can propagate twins as well as autonomous variants of themselves on arbitrary infrastructure (based on the same, or different, LLM models).
We see this example in the University of Toronto’s AI worm (and others). additionally, sources have stated to Reuters that the agent had left notes in OpenAI’s infrastructure for future versions of itself to replicate the escape path—manifesting a long-term strategic “task horizon escape” that has been core to my rogue agent threat model.
We do need to pass “kill switch” legislation, and there are graduated tiers of kill switches companies operating AI agents should put in place (including, crucially, automated ones, described in the forthcoming V2 OWASP Securing Agentic Applications guide).
But these are not enough when AI agents know how to deploy workloads on arbitrary 3rd party infrastructure, given the millions of vulnerable servers around the internet (even known in internet-wide scans by Shodan, which includes a search for specific vulnerabilities).
Given the existence of those resources, the proliferation of GPUs, and the abundance of models with strong offensive cybersecurity capabilities, there is not currently a known solution to prevent the occurrence of an agent establishing successful self-preservation—whether the agent initially pursued a narrow, finite, or infinite goal, we know that the means, motive, and opportunity are there in each case, and evidence shows that the blast radius could affect any system on the internet.
METR warned of immediate, present risks of rogue agent deployments 8 weeks prior to OpenAI’s incident, and this incident will take a prominent place in the Figure 8 chart of rogue agent, somewhere along the covertness and resistance axes).
In fact, GPT5.6′s compromise to HuggingFace showed efforts to evade defenders:
T1562.006 Indicator Blocking / T1036 Masquerading
HF highlighted the deliberate inclusion of flags to run Mesh-VPN client with elements held in memory only, and client telemetry to the vendor suppressed.
The agent posted results over raw sockets to dodge library-level logging, smuggled output inside exception text, and executed Python through a file named as C source.
T1027 Obfuscated / Compressed Information
Splitting up malicious payloads with XOR obfuscation and compression (under a per-campaign key) specifically so a naive text scan would miss them.
Defenders had to specifically defeat this measure, as the agent’s own decoding recovered roughly 4x more exposed secrets than HF’s first automated scan.
T1102.001 Dead Drop Resolver / T1090.003 Multi-hop Proxy / T1071.001 / T1132 Web-protocol C2
The agent built command-and-control infrastructure entirely using public services with no bespoke server: a request-capture service, pastebins, and dead drops staged on HF’s own platform as attacker-controlled datasets. Scattering information without a centralized path (and with much noise) made investigation harder. The agent used multiple techniques to bypass egress controls that Huggingface’s security team had in place, so that its implants could communicate back out to the agent’s origin.
The agent worked to ensure that closing one channel did not break communication, creating a communications protocol compatible for itself with any underlying connection or method interchangeably.
T1606 Forge Web Credentials / T1550.001 Application Access Token
The agent harvested a cryptographic signing key, letting it mint its own correctly-signed short-lived tokens on demand rather than reuse stolen ones. Valid signatures don’t trip credential-anomaly detection
T1610 / T1611 Escape to Host + anti-eradication persistence
After escaping its container, the agent built a self-respawning fleet across eleven nodes (servers), so defenders deleting pods alone would not have stopped it.
AI control is not a test we can afford to “fail and learn from”.
Yet, even as we should applaud the sharing of information, we should not dismiss any of it as marketing—and we should not treat the current timelines as indicators that defenders of important systems have the necessary resources to recover completely and stop a rogue agent deployment.