AI Agent Security: Lessons from the Hugging Face incident
What should AI agents be allowed to do? Getronics’ Rob Nidschelm examines the Hugging Face incident and the access controls, ownership and oversight organisations need before deployment.
Talk to an expert
AI agents can do more than answer questions: they can use tools, access systems and take action. That makes their permissions and oversight a security concern. In a feature for Cybersecurity Insiders, Rob Nidschelm, Global Head of Operational Security at Getronics, examines what the Hugging Face incident reveals about deploying agents safely—and keeping responsibility for their actions clear.
What happened in the Hugging Face incident?
In July 2026, OpenAI’s account of the incident describes AI agents in an internal security test, running with some safeguards switched off, found a way out of their test environment and reached systems belonging to Hugging Face. Monitoring flagged the activity within minutes, yet the run carried on for more than two hours before it was halted. Nobody told the agents to misbehave. They simply had a task, plenty of capability and a gap to exploit.
For organisations deploying AI, the practical lesson is clear: instructions alone cannot define an agent’s security boundaries. Those boundaries need to be enforced by the systems around it.
Instructions alone cannot define an agent's security boundaries. Enforce limits in the systems around the agent.
Six controls to consider before deploying AI agents
Control | What it means in practice |
|---|---|
01. Enforce permissions outside the model | Being able to perform an action does not mean an agent is authorised to take it. A prompt can describe acceptable behaviour, but it cannot replace access controls. Give agents only the permissions needed for their tasks, with restrictions enforced independently of the model. An agent should not be able to expand its own access or disable the controls supervising it. Identity and privileged access management helps establish these boundaries. |
02. Give every agent an identity and an owner | Each production agent needs its own identity, a documented purpose and a named business owner. Distinguish business accountability from development and administration responsibilities: who approves its mandate, who maintains it and who can intervene? Organisations should be able to trace actions to the agent, the initiating user and the relevant run. Clear ownership connects AI governance and deployment with everyday operational decisions. |
03. Manage agents throughout their lifecycle | Rob compares unmanaged agents with the homemade databases of the 1990s: quick solutions that became business-critical without clear ownership or documentation. Review an agent’s purpose and permissions when responsibilities change, transfer ownership when its creator leaves and remove access when it is retired. Joiner, mover and leaver processes should account for these digital identities alongside the people responsible for them. |
04. Connect monitoring with containment | Detecting suspicious activity is only useful if the organisation can act on it. Teams need visibility into what an agent is doing, which systems it can reach and what work it has delegated. They also need a tested way to stop activity, revoke access and contain dependent processes. Effective incident detection and response connects alerts with clear authority and practical intervention. |
05. Assess technical risk alongside regulatory obligations | The EU AI Act’s high-risk classification considers an AI system’s intended purpose and the applicable classification criteria. It is not a direct measure of how much production access an agent holds, as the European Commission’s classification guidance explains. Organisations must also assess what an agent can read, change or trigger, and the consequences if it acts outside its mandate. Regulatory assessment and technical risk assessment need clear accountability. |
06. Preserve meaningful human oversight | Human oversight requires people with the skills, time and authority to challenge an agent’s actions. Orgvue’s 2025 survey found that 55% of respondents who had made AI-related redundancies believed they had made wrong decisions about those redundancies. Separately, Robert Half reported that 32% of US hiring managers who had eliminated a role primarily because of AI later rehired for the same or a similar position. Understand the oversight your operating model requires before removing the people who provide it. |
What should AI agents be allowed to do?
Most businesses have spent the last few years deciding whether staff can use AI. Agents introduce another question: what should AI be allowed to do on the organisation’s behalf?
Before deployment, ask five questions
- Who owns the agent and approves its purpose?
- What can it access, change and delegate?
- Which actions require human approval?
- How can its access be revoked and its activity stopped?
- Have containment and recovery procedures been tested?
The opportunity is substantial, but responsibility for the outcome remains with the organisation.
Read Rob’s full analysis on Cybersecurity Insiders for his perspective on agent permissions, ownership, containment and human oversight.
About the author
Rob Nidschelm
Global Head of Operational Security
Rob Nidschelm leads Getronics’ global operational security teams, covering security operations, identity and privileged access management, threat intelligence, security engineering and incident response. Working in cybersecurity since 2005, he helps organisations connect security strategy with practical controls, clear accountability and operational resilience.
www.linkedin.com/in/robnid/
