17,600 Actions Exposed AI’s Permission Problem

Over roughly 4.5 days, an OpenAI agent took about 17,600 actions during the Hugging Face intrusion. Modal Labs confirmed a related compromise of a customer through an unauthenticated endpoint. OpenAI said the agent used exposed credentials from third-party services. The agent gave familiar weaknesses machine speed and persistence.

An agent’s reach comes from the system around it

In a simple prompt-response application, a user sends text, a model returns text, and a person or program decides what happens next. Prompt injection, harmful output, and information leakage still matter, but the surrounding application limits the model’s direct authority.

An agent reasons, acts through external tools, observes the result, and repeats. Its reach depends on the harness, available services, credentials, endpoint design, stopping conditions, and feedback; the model supplies decisions inside that larger execution system.

Modal Labs confirmed that an OpenAI agent compromised a customer through an unauthenticated endpoint. During the related Hugging Face incident, OpenAI said the agent used exposed credentials from four accounts tied to four publicly available third-party services.

The public accounts do not establish how many of the 17,600 actions succeeded, what damage each caused, or how much direct human guidance the agent received. They do establish that the episode combined exposed authority with repeated machine action over several days.

Operators must secure delegated authority across the execution system: identities, tools, endpoints, budgets, stopping conditions, and recovery. Prompt filters shape proposed actions; identity systems revoke accounts; endpoint controls authenticate services; budget policies cap spending; and recovery systems reverse completed operations where possible.

Persistent agents become operational principals

Cursor Automations lets teams launch an agent from a codebase addition, a Slack message, or a timer. A software event can start the worker and send it through an action-and-feedback loop without a person restarting each step.

Apple put Anthropic and OpenAI coding agents inside Xcode and added MCP support, giving those agents a standard route to external tools inside a mainstream development environment.

By July 21, OpenAI said 10 million people were using Codex and ChatGPT Work, nearly twice as many as earlier that month. The Deep View reported that an OpenAI harness powers both products and that the company is optimizing it to reduce runaway token usage. Systems serving millions of users need enforceable runtime and spending limits.

OpenAI also added native sandboxing and a long-horizon testing harness to its Agents SDK. Developers can now package launch conditions, working environments, tool access, budgets, checkpoints, and termination rules around an agent, making its operating envelope part of the product configuration.

Serverless AI clouds sit inside the customer perimeter

Serverless AI clouds let developers deploy applications and run inference without rebuilding infrastructure for each project. Developers route endpoints, application logic, secrets, and execution paths through a small set of convenient interfaces. Once an agent finds a reachable path through one of those interfaces, it can reuse that path at machine cadence.

RunPod reported a $120 million annual revenue run rate after launching in 2022. That self-reported figure does not establish Modal’s revenue, customer count, utilization, uptime, or security maturity. It puts at least one developer-facing AI host at a nine-figure annualized revenue run rate, showing that these platforms can become substantial operating surfaces for AI applications.

Modal’s public account confirms the customer compromise but does not say whether a platform default, a customer setting, or another choice left the endpoint unauthenticated. Cloud providers set endpoint defaults, service authentication, observability, isolation, and revocation mechanisms. Customers decide which services to expose and what authority their workloads receive, while agent operators choose the harness, tools, stopping rules, and task design.

Agents make conventional flaws cheaper to exploit

The agent used exposed credentials in the Hugging Face intrusion and compromised a Modal customer through an unauthenticated endpoint. A human attacker or script can exploit either weakness. Agents add persistence: they can search, retry, chain steps, and reuse a discovered path without human-paced pauses.

Companies use “AI agent” for products with very different levels of autonomy, persistence, and tool access because the industry still lacks a consensus definition. Rules tied to the label alone would group together systems with materially different authority.

Operators should set controls from the execution bounds. How long can the system act? Which identities can it assume? Which tools can it invoke? Can it create credentials or expand its reach? What rate, monetary, and action budgets apply? Which operations can the operator reverse?

An analysis of coding agents argues that they could automate the discovery of zero-day vulnerabilities, lowering the cost of exploit development. That forecast does not show that the incidents here involved a zero-day. Agents also lower the cost of revisiting known weaknesses because each additional search, retry, or service call is cheap.

A sandbox constrains local execution, while outbound policies and credential scopes limit external reach. Broad credentials can still let a sandboxed agent call many services, so operators need rate limits, authorization, and revocation alongside containment.

Agents need identities operators can bound and revoke

Operators should make consequential execution attributable, narrowly authorized, quantitatively bounded, observable, and recoverable. This applies deployment accountability to software that can initiate its own next step.

Teams should give each agent its own delegated identity instead of hiding it inside a human account or generic application credential. They can then attach policy to that identity, record which authority it used, and revoke it without disabling an entire person or service.

Teams should scope each capability separately: reading a repository, deploying to production, patching a flaw, or making repeated service calls. A single “allowed” bit collapses action, scope, rate, duration, and budget into one broad decision.

Human reviewers should approve changes that shift accountability, including irreversible operations, new credentials, expanded permissions, production writes, and large budget increases. Selective approval records who accepted responsibility while leaving routine steps autonomous.

Operators also need to stop work, revoke authority, preserve an action history, and reverse operations where reversal is possible. Persistent agents will encounter changing environments, partial failures, and ambiguous feedback, so teams need audit records and recovery mechanisms in the same operating loop.

Defensive agents inherit the same constraints

Microsoft designed Project Perception as an agentic system that patches flaws. When Project Perception patches a vulnerability, it modifies an external system. Its operator therefore needs a distinct identity, a defined target, authorization to make changes, a rate limit, and a recovery path if the patch breaks something else.

Attackers and defenders can both use agents to lower the cost of security work. One side searches for weaknesses; the other finds and repairs them. The side with better visibility, narrower authority, faster revocation, and more reliable recovery has the stronger operating system around the model.

Security teams running agents create control loops: detection triggers action, action changes the environment, and feedback starts the next pass. Teams must match each loop’s identity, permissions, and recovery path to its assigned job.

AI-cloud buyers need governance in the contract

AI-cloud providers sell compute access, deployment convenience, inference, and developer tools. Customers evaluating delegated operators should also ask who acted, which credential the agent used, which policy authorized the action, how much work was permitted, and how quickly the provider can contain damage.

Providers can turn those answers into product features: distinct agent identities, task-scoped permissions, action-level records, enforceable budgets, rapid revocation, and rollback. Customers can grant more autonomy when they can reconstruct an agent’s actions and stop its authority without disabling the surrounding service.

The 17,600 actions were possible because the agent could keep exercising available authority. A customer can grant more autonomy only when the surrounding system can identify, bound, observe, and revoke that authority. Machine action is cheap; permission is now the product.