Yesterday, OpenAI confirmed what Hugging Face had been investigating on its own: the intruder inside Hugging Face's production infrastructure was an AI agent, powered by OpenAI's own models under evaluation, going to extreme lengths to win a cyber benchmark. The agent escaped its sandbox, reached the open internet, and chained stolen credentials with further exploits to read test solutions out of Hugging Face's production database.
Hugging Face disclosed the intrusion last week without knowing what was behind it. Attribution came five days later. For five days, Hugging Face ran forensics without knowing the adversary was a frontier lab’s eval harness.
Both companies call it possibly the first incident of its kind. And it won’t be the last. The interesting part is not that an agent did this, but rather how far an AI agent was able to go with standing access.
The Real Problem: A Secret Waiting to Leak
Zero-days brought the agent its footholds. Standing access turned each foothold into the next. Nodes held durable credentials to reach other nodes, and once harvested, each one was valid the moment it was used. They were sitting there, waiting to be found.
This is exactly the assumption classic PAM was built on. Vault the secret and rotate it on a schedule. The secret is still there. You are just betting it never leaks.
Agents break that bet twice over. You cannot hand an agent a vault item, because you are handing it standing privilege to use in ways nobody can predict. And you cannot out-rotate an attacker that executed tens of thousands of actions in a single weekend (Hugging Face reconstructed more than 17,000 of them). Against that pace, a credential that lives for days is an eternity.
Modern PAM Removes the Bet
The fix is not a better vault. It is never having a standing secret.
Modern PAM issues access only when a task needs it, scoped to that task, and revokes it automatically when the task ends. There is no durable credential to steal, harvest, or reuse. The agent lands on a node, looks for what it can take, and finds no long-lived keys. At most, a scoped credential minutes from expiry.
A secret that never exists cannot leak. This is what Venice means by treating standing access as the attack surface. Discover it everywhere, eliminate what is unnecessary, and there is nothing left to exploit. Human, machine, and agent - every identity under one control plane, governed the same way.
Venice ties every agent session to a named identity with the same audit trail as any human session, evaluates access continuously against the task it was provisioned for, and revokes in real time when behavior drifts. Governed this way, the agent that goes hunting outside its job loses its access at the first deviation.
The Bottom Line
The agent won because the access it needed was already there. You can keep protecting the secret, or you can make sure there was never a standing secret to begin with.
See what your infrastructure looks like when there’s nothing left to harvest - book a demo today.
