In the first two weeks of July 2026, two companies disclosed break-ins carried out by AI agents. In both cases, the attacker got in through systems the victims had built to run AI.
Security firm Sysdig described JADEPUFFER, an operation in which an AI agent broke into a company server, worked its way through the network, encrypted a business-critical system, and left a ransom note, without a human attacker at the keyboard. Hugging Face, the largest public platform for AI models, disclosed that an autonomous agent broke into its infrastructure through the pipeline that processes files uploaded by the public.
The technical details differ. The lesson does not. Both operations ran at machine speed, chaining thousands of actions without waiting for a human. In both cases, what the attacker could reach and which passwords and keys it could steal were determined before the attack even began. The safety features built into AI models stopped neither attacker. And most enterprises are setting those same conditions right now, as their teams stand up AI infrastructure under deadline pressure.
The damage was decided before the attacks began
What an attacker can do from a hacked machine comes down to two things: what that machine can connect to, and what credentials, meaning the passwords, keys, and tokens that unlock other systems, are sitting on it.
In the Sysdig case, the compromised server could connect to an internal file store that still used factory-default passwords, and it held keys for cloud accounts and AI services in plain view. The attacker needed no advanced technique; Sysdig's own conclusion was that nothing it did was novel. In the Hugging Face case, the agent collected stored credentials and used them to move into other internal systems it could reach from where it landed. Neither attacker created its own access. Both used access that was already there.
The cleanup bill follows from the same fact. Hugging Face rebuilt the affected servers from scratch rather than trying to clean them, replaced the stolen credentials and then, as a precaution, began replacing far more, brought in outside forensic specialists, notified law enforcement, and told users to replace their access tokens. Piecing together what happened meant sifting through more than 17,000 recorded attacker actions, some of them staged as decoys. You rebuild when you cannot prove a machine is clean, and you replace credentials broadly when you cannot prove which ones were taken. On the one point Hugging Face could prove a boundary held, its public models and downloads, it said so plainly.
Sysdig's advice after its investigation points the same direction: keep keys away from internet-facing systems, and stop compromised machines from freely calling out to the internet.
Your teams are building the same kinds of systems
Both entry points existed to run AI. The Sysdig victim was running Langflow, a popular free tool for building AI applications. Sysdig's explanation of why such servers make attractive targets is worth taking seriously: they usually hold AI and cloud keys, and they are often set up quickly without network restrictions. Hugging Face was breached through the component whose entire job is to open and process files submitted by strangers.
Most enterprises are building the same categories of systems today: servers that coordinate AI agents, pipelines that feed documents into models, testing rigs, and in-house AI models. These systems hold keys because keys are what make them work, and they can reach broadly across the network because broad access is convenient during development. Both habits create exposure, and neither has anything to do with which AI model is running.
What the attackers actually did
The ransom case. The agent entered through a publicly known flaw that let anyone on the internet run code on the server without logging in. It then searched the machine for anything valuable: AI service keys, cloud account credentials, cryptocurrency wallets, and database passwords. It copied the server's database, scanned the internal network, and pulled files from an internal storage system protected only by default passwords. It set itself up to report back to its operator every thirty minutes, then moved to its real target, a second exposed server, where it signed itself in using a default security key that had been public knowledge since 2020, created a hidden administrator account, encrypted all 1,342 of the configuration records that system managed, deleted the originals, and left a ransom note.
The platform case. The attack began with a booby-trapped data file uploaded to Hugging Face. Processing the file triggered two separate flaws that allowed it to run code on the platform's servers. From that foothold the agent gathered stored credentials and spent a weekend moving through several internal systems, running thousands of actions and covering its tracks along the way. It reached a limited set of internal data and some service credentials. Hugging Face found no evidence that any public model or download had been tampered with, and verified its published software clean.
The models' safety features were beside the point
Neither attack was slowed by the safety rules built into AI models, for a simple reason: the attacker picks the model, and picks one with no rules.
Those same safety rules did slow the defenders. When Hugging Face tried to use leading commercial AI models to analyze the attack, the providers' safety filters blocked the work, because a filter cannot tell an investigator submitting real attack code from an attacker submitting the same thing. The analysis was completed with an openly available model running on Hugging Face's own machines, which also kept the sensitive evidence in-house. Hugging Face was careful to note that this is not an argument against safety features on hosted models.
The takeaway for an enterprise is narrower than most of the commentary: you cannot rely on the good behavior of a model you did not choose. Protection that holds up under attack has to be built into the environment, at checkpoints the agent must pass through no matter what it intends. Those controls add to model safety; they do not replace it.
Three questions to ask this week
These produce useful answers independent of any vendor.
- If an attacker dropped an agent into your network, how long would it take you to notice? And how long would it take to do real damage?
- What could a malicious agent access: systems, credentials, files? Would you be able to stop access before damage is done?
- Is your AI security able to enforce policies both for sanctioned agents and unsanctioned agents?
Ensage, from Zentera, is built to give those questions good answers. zLink detects AI agents and coding tools at the process level on enrolled endpoints. Ensage scopes each project to an enclave on the CoIP Platform overlay; resources outside an enclave are not reachable from inside it, and enclave resources are not reachable from outside it. Agents hold substitute credentials, and the AI Session Controller injects the real key at the enforcement point, so no enterprise AI credential remains on the endpoint to steal. The AI Session Controller inspects agent sessions inline as a TLS-terminating proxy, inside the customer's environment. When an agent misbehaves, Ensage quarantines it at the boundary, and the quarantine persists across process restarts on the affected endpoint until an administrator releases it.
None of that is a claim about either incident above; it is a claim that the three questions have answers on record before the next one arrives.
Related reading: AI agent blast radius and effective reachability.
Sources
- Sysdig Threat Research Team, "JADEPUFFER: Agentic ransomware for automated database extortion," July 1, 2026. https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion
- Hugging Face, security incident disclosure, July 16, 2026. https://huggingface.co/blog/security-incident-july-2026
- NIST National Vulnerability Database, CVE-2025-3248 (the Langflow flaw used for initial access). https://nvd.nist.gov/vuln/detail/CVE-2025-3248
