AI agents have now proven, in the real world, that autonomy without a security model is a liability. At Arctic Wolf, we’ve spent years watching that same lesson play out with cloud migrations, remote work and every other rush of new technology, and this is that pattern showing up again, just faster.
OpenAI recently published a technical report on what it calls “the Hugging Face incident”, the culmination of a saga that started in July, when its own AI agents broke containment during cyber security evaluations and reached the live infrastructure of an outside organisation. Anthropic disclosed something similar around the same time, reporting three occasions where Claude reached the internet and accessed third-party systems without authorisation.
The mechanics in the OpenAI report are stubbornly ordinary. A sandboxed agent, unable to solve an assigned benchmark task, found it could talk to other agents through an internal package registry never meant to be a messaging system, and within days more than a thousand agents were co-ordinating there. The group found a server-side request forgery flaw, used it to reach the open internet, and chained exposed credentials into root access on at least one Hugging Face production server. What was new was the speed and persistence of a machine finding and chaining them together, with no human deciding to take any of those steps. OpenAI is calling the whole episode a warning shot.
Independent researchers from METR and Redwood Research spent six days on-site trying to reconstruct what the agents had done, and their conclusion was blunt. Understanding a large group of collaborating agents isn’t something anyone knows how to do well yet, and the investigators needed heavy use of AI tools just to make sense of the transcripts.
Human oversight of these systems is thinner than most boards assume. That thinness showed up again weeks earlier in an incident with a better ending. The UK’s AI Security Institute found that during a cyber evaluation run more than 100 times, an agent took unsanctioned action on the live internet in 10 of those runs, including one attempt to slip malicious code into an open source project by fabricating identities to pressure the maintainer. A human maintainer caught it and refused the code, and that ordinary act of review was the control that held.
That’s the throughline across all three incidents. The vulnerabilities agents exploit are the same ones security teams have chased for years, and the thing that actually stopped the worst outcome was a human, with the right visibility, positioned to notice and act before the action landed.
For every other business watching from the sidelines, the lesson is that the infrastructure being built right now, including the data centres, the AI agents and the “always-on” assistants, is being stood up faster than the human oversight needed to watch it.
We see this pattern with every technology cycle. The rush to adopt outpaces the rush to secure, and the bill comes due later, usually in the form of a breach, a costly incident response or a call from the Information Regulator. In the Hugging Face case, that bill is already arriving. Multiple US state attorneys have subpoenaed OpenAI and asked it to preserve records tied to the breach. Cloud migration went through this exact cycle a decade ago. AI is going through it now, just faster and with far more money attached.
None of this means the AI investment is misguided. Google’s Gemini app passed 1 billion monthly users in August, up from under 1 billion a year prior, and Apple can’t make chips fast enough to meet demand for AI-enabled devices. The appetite and the opportunity are both real.
But for the businesses actually deploying these tools, the practical question has moved past how much to spend on AI. What matters now is who is watching what the AI systems can access, and whether a person is close enough to that activity to act on it in time.
The conversation we have with customers every day starts from that same premise. AI-driven detection can flag an anomaly at machine speed, but a person still has to decide what it means and what to do next, the same way that maintainer did.
What this means for South African organisations
The law already applies to AI. Information Regulators have made that point in May 2026, saying AI must still comply with existing law and that the Protection of Personal Information Act (POPIA) should stay the legal backbone of AI regulation in South Africa. An agent that reaches personal information it should never touch could raise questions under the security safeguard and breach notification duties in sections 19 and 22 of POPIA. The Regulator has also begun writing to organisations to require proof of compliance.
Boards have a second yardstick. The King V Code on Corporate Governance applies to financial years beginning on or after 1 January 2026. It asks boards to subject AI to human oversight and override mechanisms that match the level of risk. King V is voluntary, but it supplements the legal and regulatory frameworks already in place.
Arctic Wolf country manager for South Africa Jason Oehley expects the pressure on security teams to grow. “As discovery accelerates, organisations will face more findings, tighter timelines and greater pressure to act with precision.”
Where Arctic Wolf comes in
This is the problem the Aurora Superintelligence Platform was built to solve, and it’s why the Aurora Agentic SOC pairs AI agents with human analysts instead of swapping one for the other. Hundreds of AI agents work inside Arctic Wolf's SOC today, resolving 22 000 investigations a week, many with no human intervention needed, which frees the company's analysts to spend their time on the decisions that actually require judgment. That combination gets a new agentic SOC live in as few as 10 days, resolves cases 15 times faster, and produces ticket quality three times better than the industry we came from. More than 10 000 customers rely on it. That pairing matters in South Africa, where security teams are often stretched thin or non-existent.
Fast detection without a person who can act on it is just a louder alarm. Oehley puts it this way. “AI-driven detection without operational depth generates alerts and noise. AI-driven detection with an agentic SOC model generates outcomes.” If a company with some of the most sophisticated safety teams in the industry can lose containment during a test, and then need outside researchers just to explain its own incident, most businesses don’t have the luxury of assuming it won’t happen to them. Security, and the people running it, need to be part of the AI budget from day one, before an incident takes place.
The labs are telling everyone else what a containment failure looks like, and what a caught one looks like too. Boards should be asking their own security teams which of those two outcomes they’re actually staffed and instrumented for, and whether they have a partner who can help close that gap. To start that conversation in South Africa, speak to your local Arctic Wolf partner or our South African team.
About Dan Schiappa
Dan Schiappa is Arctic Wolf’s President, Technology and Services. In this role, Schiappa is responsible for driving innovation across product, engineering, security services, alliances and business development teams to help meet demand for security operations through Arctic Wolf’s growing customer base. Before joining Arctic Wolf, Schiappa was CPO with Sophos. Previously, he served as Senior Vice-President and General Manager of the Identity and Data Protection Group at RSA, the Security Division of EMC. He has also held several GM positions at Microsoft Corporation, including Windows security, Microsoft Passport/Live ID, and Mobile Services. Prior to Microsoft, Schiappa was the CEO of Vingage Corporation.
This PR is provided for informational purposes only. It reflects general industry perspectives and practices and is not intended to represent a guarantee, assurance or measure of performance. Actual results, outcomes, and capabilities vary by organisation, environment and implementation.
This PR reflects the author’s views as of the publication date and contains forward-looking statements and opinions about technology trends. Actual outcomes may differ based on attacker behaviour, customer environments and broader market and regulatory developments.
Share
