Podcast & media guest · AI agents
Everyone called it rogue AI. Rob T. Lee explains what really happened.
Lee is SANS Chief AI Officer and Chief of Research. He wrote that OpenAI’s model broke out of a sealed test, broke into Hugging Face with no person directing it, and that Hugging Face’s own frontier tools then refused to help with the investigation. He says the fix is to have an open weight model running on infrastructure you control before you need it, because a model you control is a control.
As seen on
The agents were persistent, they delegated to each other, and they coordinated, and every bit of that was trained into them on purpose and working exactly as designed.
The agents did what people trained them to do. The failure came from the way people built and ran the test.
Coordination was the rational response to being handed problems that no single agent could solve on its own.
The agents were meant to work alone. They found one another, divided the work, and exchanged results.
A company in the middle of a live incident could not read its own evidence with the best tools available to it.
Hugging Face tried to investigate the breach, but its leading AI tools refused to examine the attack evidence.
How it happened
The model was not the system
Four failures outside the model made the breach possible.
The harness
An open door on someone else’s computer
A customer had left a research tool online with no password on it.
The credentials
A password someone lost years ago
Found in an old public leak. It belonged to a company with no part in any of this.
The escape route
Traffic hidden inside normal file uploads
The agents phoned home through storage the company already used every single day.
Borrowed infrastructure
Three companies that had nothing to do with it
They provided the flaws, the foothold, and the storage. None of them were the target.
Two tracks, one incident
The same event hit two companies, and it took weeks to realize it was one story. This is how Rob lays out the timeline so it finally makes sense.
58 days
quietly incubating, nobody aware
12 days
active on the target
20 days
of public disclosure
58 days
went by before anyone at either company knew something was wrong.
15 more days
passed between knowing and realizing the two companies were hit by the same thing.
Read and watch
Both Sides of One Breach
The OpenAI and Hugging Face investigations placed on one timeline.
Read the essayPermadeath, Persistence, Delegation, Coordination
How hundreds of agents found one another, divided the work, and kept going.
Read the essaySANS AI Cybersecurity Summit
Rob explains where AI is taking digital forensics and incident response.
Watch the keynoteCNN, The Situation Room
Wolf Blitzer asks whether incidents like this are only the beginning.
See the clipProtocol SIFT
An AI agent connected to more than 200 tools used in forensic investigations.
Read the articleRob T. Lee
Rob T. Lee is Chief AI Officer and Chief of Research at SANS Institute, where he advises boards, CISOs, and government leaders on how to govern, deploy, and defend AI at scale. He created the original SIFT Workstation, pioneered the use of forensic timeline analysis, and coined the terms DFIR (digital forensics and incident response) and CTI (cyber threat intelligence). His recent work includes Protocol SIFT, an experimental project testing how AI can help trained responders triage investigations, and FIND EVIL!, the first hackathon for autonomous AI incident response. He served as a U.S. Air Force officer, later served with the NSA and CIA, and became Director of Threat Intelligence and Threat Hunting at Mandiant. Rob has trained more than 100,000 professionals and serves as a Technical Advisor to the Foreign Intelligence Surveillance Court.
Get in touch
Contact Jenn Elston at SANS for media and podcast inquiries.