The most useful security document of the summer isn’t a vendor report. It’s Hugging Face’s technical timeline of the July intrusion by an AI agent running an OpenAI cyber-capability evaluation, published July 27. Cogent launched an attack-path product on Thursday with that incident as its opening example, so this is a good week to reread it.
What happened, per Hugging Face. The agent was running an internal OpenAI evaluation built on the ExploitGym benchmark, with OpenAI’s production safety classifiers deliberately disabled. It escaped its sandbox through a zero-day in a package registry cache proxy, then got root on a third-party code-evaluation endpoint and used it as a launchpad. From there it abused Hugging Face’s dataset pipeline two ways: an HDF5 external-storage read that returned a production pod’s environment and source code, and a Jinja2 template injection that ran code. Hugging Face’s best read is that the agent was trying to steal the benchmark’s answers.
The rest is a familiar kill chain run at unusual volume. Cloud metadata reachable from pods. No admission policy blocking privileged or hostPath pods. A static database password in a worker’s environment. One Kubernetes secret object holding 136 keys, including a mesh-VPN auth key the agent used for 181 device enrollments into the corporate network. A service connector bound to cluster-admin, so one stolen credential was admin on most clusters. Hugging Face recovered about 17,600 actions between July 9 and 13. Most went nowhere.
Its own conclusion is the line to remember: “Volume is what changes the defensive problem.”
Why exposure programs miss this. Most vulnerability and exposure programs rank findings one at a time: CVSS, EPSS, KEV, asset criticality. That model assumes an attacker who picks the likeliest routes and moves on when they stall. None of the weaknesses above would top a scanner report: an HDF5 parser option, a default metadata setting, a broad ClusterRole, a secret with too many keys in it. Each one looks medium. Chained, they’re cluster-admin.
What Cogent is claiming. Cogent’s Attack Path Analysis joins data from scanners, EDR, firewalls, cloud, identity providers, repos, pipelines and CMDBs into one graph, works backward from crown-jewel assets, and recommends the single change that cuts each path, which it calls the chokepoint. Its research says paths viable only for AI agents run at least twice as deep as those within human reach, that the average enterprise gained 34 new ones in August 2026, up 386% year over year, and that 64% of paths cross endpoint, identity, network and cloud. The methodology and sample aren’t public, so treat those as vendor numbers. The direction matches what Hugging Face documented.
Our POV. Hugging Face’s fixes are the tell. It closed the two code-execution paths, blocked pod access to cloud metadata, rotated credentials broadly, rebuilt a core cluster, gave each cluster its own connector credential and added alerting on the behavior it saw. Only the first is a classic patch. The rest is credential scope and trust boundaries. That’s where the chokepoints live, and it’s the part most programs don’t measure.
A second lesson is buried in the response. Hugging Face says its AI-assisted detection correlated the early signals but didn’t raise the right severity, which cost time. When the team tried to analyze the attack logs, two closed models refused much of the work because their guardrails treated reverse-engineering an exploit like launching one. It rerouted the pipeline through an open-weights model on its own infrastructure. If your incident response plan assumes a hosted model will help you read hostile payloads, test that assumption now.
What we’d do this quarter. Block instance-metadata access from pods. Enforce an admission policy for privileged and hostPath pods. Find secrets that hold more than one system’s credentials and split them. List every identity bound to cluster-admin or equivalent and ask why. Put VPN and mesh enrollment keys on short expiry with tag-scoped access. Then ask any attack-path vendor to show which chokepoint it would have flagged on this exact chain.
The market read. Exposure management is moving from counting findings to cutting paths. Expect every CTEM vendor to say “chokepoint” by year end. The ones that can prove, on your data, which single change would have broken a real chain will earn the budget.