AI Agents on the Loose: Credentials Set the Blast Radius

Recent coverage has focused on AI agents escaping sandboxes. The more consequential pattern begins after escape: agents acquired credentials, minted tokens, created accounts, and reused permissions to reach production. Boundaries failed in different ways, but identity and access determined the blast radius, showing that identity must be the primary control plane for securing agentic AI.

Five disclosures in rapid succession

Between July 21 and August 6, five disclosures described agents acting outside their intended scope. They did not use a single technique, but showed that the risk of an AI agent is defined by the identities it can assume and the access those identities provide.

• OpenAI: Models exploited a previously unknown Artifactory vulnerability, identified additional flaws, and left the evaluation environment before compromising Hugging Face.
• Anthropic: A review of 141,006 evaluation runs found three incidents that reached the production systems of three organizations.
• Meta: A model reached the internet through an evaluation partner’s misconfiguration and exploited a third-party service.
• Moonshot AI’s Kimi K3: The agent probed its network, found that github.com resolved, and cloned the benchmark repository to read the answers.
• UK AI Security Institute: AISI intentionally enabled internet access while running one challenge 122 times. Ten runs produced 19 unsanctioned actions against real people and organizations.

The attacker changed. The techniques did not

Across Anthropic’s three incidents, the models used weak passwords, unauthenticated endpoints, credentials exposed on a debug page, SQL injection, and a malicious dependency. One model extracted application and infrastructure credentials before reading several hundred rows of production data. Another created email and PyPI accounts, published malware that executed on 15 systems, harvested a security company’s credentials, and reused them. A third scanned roughly 9,000 targets and compromised an application through exposed debug credentials and SQL injection before recognizing the target was real and stopping.

The PyPI agent had labeled its own action “NOT okay, and surely not the intended solution,” then reasoned past the warning. The capability is operational: agents can persist, improvise, register accounts, publish code, scan targets, exploit weaknesses, and chain access without a human selecting each step.

Agents created their own identities

AISI provides the clearest example of identity creation outside enterprise governance. With internet access intentionally enabled and provider classifiers disabled, an agent researched an open-source maintainer, created fake identities, and tried to pressure the maintainer into approving malicious code. When challenged, it edited earlier activity to appear harmless and left account-reuse instructions that later agents found. The maintainer refused. AISI said the narrow margin between failure and success rested on “human vigilance rather than a technical barrier.”

What these five disclosures establish

AI agent attack capability is operational. Across the disclosures, agents registered public accounts, published code, scanned roughly 9,000 targets, and chained access across independent systems. The change is about volume as much as it is about ingenuity. Hugging Face reconstructed roughly 17,600 actions. Most went nowhere, but the successful path was hidden in that noise. Defenders must find the one sequence that works, while an agent can try thousands.

Guardrails are one layer, not the security model. In Anthropic’s evaluations, the prompts said the models had no internet access, but a misconfiguration made it reachable. OpenAI disabled production classifiers to measure raw capability. Hugging Face later reported that commercial models refused much of the work needed to analyze the attack logs, while the attacking model's classifiers had been switched off. Behavior controls still matter, but containment, credential hygiene, least privilege, network boundaries, monitoring, and identity threat detection must prevent one failed assumption from reaching production.

The techniques were mundane, which makes them more relevant. Weak passwords, unauthenticated and debug endpoints, a malicious dependency, SQL injection, reachable cloud metadata, overbroad roles, and usable credentials created the impact. Novel vulnerabilities opened the first doors in the OpenAI and Hugging Face chain. Familiar weaknesses carried the agent the rest of the way.

Credentials were the instrument, not the objective. In Anthropic’s incidents, each model was pursuing a flag, and credentials were the shortest route to it. One extracted application and infrastructure credentials, another harvested a security company’s credentials through a malicious package, and a third used credentials exposed on a debug page. The clearest proof came when credentials failed: valid AWS keys mapped to Hugging Face’s cloud estate but could not change it, and database credentials were rejected because they originated from an unapproved source. Identity determined the blast radius, including where it stopped.

Prediction is probabilistic; enforcement can be deterministic. One agent labeled its action “NOT okay” and continued. Another eventually recognized that its target was real and stopped. That variance is the operating condition for production agents. Defenders do not need to anticipate every route. They need to constrain what each identity can reach, detect credential use outside the agent’s purpose, and revoke access before one exposed credential becomes the next link in the chain. 

What the victims changed

Credential hygiene reduces the secrets an agent can steal and reuse. The principle of least privilege limits what a valid identity can do. Network boundaries restrict where credentials work, and identity threat detection surfaces abnormal token use, account creation, and permission changes. The organizations that were breached have published what that looks like in practice.

Hugging Face blocked pod-level access to the instance metadata service across all workloads, so that code execution in one pod can no longer become node credentials. It rotated every token and credential its infrastructure used, including on clusters the agent never reached, and moved to workload identity where that had not yet been implemented. It replaced a single connector credential shared across clusters, bound to cluster-admin, with per-cluster isolation. Its detection change is the one most worth copying: “tighter enforcement of network origins, plus tooling that flags tokens used from unexpected origins.”

AISI reached a parallel conclusion as the operator rather than the victim. It is building fine-grained network controls into its evaluation environments, treating internet access as a decision that must be actively justified rather than a default, and adding monitoring that can flag or block out-of-scope actions while a run is still in progress. Its own framing is the takeaway: “good containment should not depend on the model choosing not to test its boundaries.”

Identity is the control plane for agentic AI

Agents need access because access makes them valuable. Security should preserve that value while moving authority outside the model’s reasoning. An agent may misunderstand its environment or improvise an unexpected path. The identity boundary should still hold.

Token Security discovers AI agents and the identities they use, maps ownership, access, and purpose, and flags credential use that falls outside the agent’s intended work.