The cage was never the problem. The keys inside it were.

On July 8 we wrote that isolating where an agent runs tells you nothing about what it can take, because the credentials it needs to do its job sit inside the cage with it. Eight days later Hugging Face disclosed that an autonomous agent had run more than 17,000 actions across its internal clusters.

Nothing escaped. Nothing had to.

It started with a malicious dataset carrying two ways to execute code: a remote-code loader and a template injection in the dataset's config. Loading it was enough to run code on a processing worker.

That worker was the boundary. It held. It just didn't matter.

The agent took node-level access, harvested the cloud and cluster credentials sitting on that machine, and used them to walk into other internal clusters. It kept a swarm of short-lived sandboxes running, re-staging its command-and-control on public services as each one died. Over a weekend, 17,000 actions. Nobody typed one of them.

The credentials on that worker were valid everywhere the agent chose to point them.

The key was just lying there.

Hugging Face handled the hard part well. Detection caught an attack built to look like ordinary automation, containment held, and they verified that public models, datasets, and Spaces were untouched and the supply chain clean. The disclosure was straight about what did go: a limited set of internal datasets, and credentials several services depended on. The forensics were harder than they should have been, for reasons that are somebody else's argument to have.

Ours is the credential. A secret that lives on the machine where code runs belongs to whatever runs next. That is true of a .env on a laptop and it is true of a cloud credential on a processing worker at a company that does this for a living. The agent needed no clever escape. It needed a key that worked somewhere else, and the key was lying there.

Keep the keys out of the cage.

A credential that exists only for the instant of the call is not on the worker when an agent starts looking. One pinned to the machine it was issued to is dead weight in the next sandbox. An agent that can reach only the single thing it was named to reach cannot discover the cluster next door. And every use is written off the box, hash-chained, where a process that owns the machine cannot rewrite its own history.

None of that patches a dataset loader. Code still runs on that worker, and a credential live in that instant can still be spent in that instant. What changes is the inheritance: one scoped, expiring key for one job, instead of a keyring that travels. The intrusion still happens. It stops being a weekend.

The cage is fine. Empty it.

Hugging Face's cage worked. Every agent platform is racing to build a better one, and that is the wrong race to be winning alone. Ask the other question: when something inside it is turned against you, what is within reach? If the answer is a credential that works on the next machine, you didn't build a sandbox. You built a room with the keys taped inside.

The properties a credential should hold when the process gripping it is taken: https://x.com/clavitorai/status/2071121333719625842

Clavitor (@clavitorai) is the credential vault built for AI agents, and against them. clavitor.ai

Sources

Hugging Face (@huggingface): "Security incident disclosure — July 2026." The primary disclosure. An intrusion driven end to end by an autonomous agent system, entering through the data-processing pipeline via a malicious dataset abusing two code-execution paths (remote-code dataset loader, template injection in dataset config). Unauthorized access to a limited set of internal datasets and to several credentials used by its services. No evidence of tampering with public models, datasets, or Spaces; software supply chain verified clean. More than 17,000 recorded attacker actions. [1]

The Hacker News (@TheHackersNews): "World's Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent." [2]

Clavitor (@clavitorai): "The cage holds where the agent runs. Not what it can take." July 8, 2026 — the prediction this incident tested. [3]

(Verify handles are live before posting: @huggingface, @TheHackersNews.)