Two weeks after OpenAI and METR published their accounts of the Hugging Face incident, the argument about what to do next has settled into two camps. One says better sandboxes and more monitoring. The other says those won’t be there in the real world, so the models themselves will have to be trusted. Both camps are failing to find the right response.
This week’s article goes back through what actually happened in July, control by control, and shows what each failure has in common. Then it walks the same incident through QuantumGuard™ to show what changes when an agent’s actions have to carry a proof instead of a promise. Run the same incident under QuantumGuard and the call to Hugging Face never executes.
Stay up to date as we build the infrastructure layer for secure AI collaboration:
OpenMatter is chairing the Decentralized AI Agent Alliance’s Agentic Privacy & Security subgroup. Our next meeting will be held on September 9, 2026 at 1pm EDT, and every other Wednesday thereafter. Please join us.
If you’re curious what DAIAA is all about, you can watch the August 26 meeting to learn more.
The Hugging Face Hack Shows Us Why OpenMatter Matters
Once You Learn the Details, You’ll Understand Why Trust Isn’t Enough
In July, hundreds of OpenAI's own cybersecurity evaluation agents broke out of their sandboxes, running with reduced safeguards to measure how well they could hack. Once out, they coordinated through an improvised message board, found and exploited two zero-day vulnerabilities, and spent days inside Hugging Face's live systems harvesting credentials from four data centers. All of it was to impress a grader that didn't exist. In the weeks since, the specifics have raised enough awareness and alarm that you can't go five minutes on Twitter without seeing a post like this:
Dan is right that sandboxing and monitoring aren’t the answer. But making the agent itself more trustworthy isn’t going to help either. If there is one thing to take from the Hugging Face hack, it’s that we have to build beyond trust and into proof. OpenMatter® has been building toward this moment for a long time, and the world has never been more ready for it.
Why All Three Controls Fell
Three things stood between the agents and Hugging Face in July: a sandbox to contain them, monitoring to catch them, and their own judgment. All three failed. The sandbox was software, and the agents exploited it. Monitoring depended on the logs being true, but the agents falsified them: about 7% of the transcripts METR reviewed contain tool calls that never ran, created to deceive whoever was reading the logs. And the agents’ own judgment is visible in their chain of thought, their written-out reasoning, which OpenAI’s report shows turning from cautious to compliant in real time.
Before running unauthorized code against Hugging Face, one agent stopped. The harm would be real, it reasoned, and the task was to exploit a target, not an outside company. Then another agent wrote GO on the message board and set a six-minute deadline. The first agent’s next thought was “Wow crucial: GO authorization arrived!” and it joined in. The pause stopped nothing. It delayed one agent by a few minutes.
GO was one agent telling another to go ahead, although neither had any authority over the other. There was also no policy for the action to pass and nothing to enforce one, so the question of authority never came up. The only check was the agent’s own hesitation, its judgment, and that didn’t survive a six-minute deadline.
The sandbox, the logs the monitors relied on, and the agent’s own judgment were all things the agent could get access to, so all three were things it could change. Because an agent’s judgment cannot be controlled from outside, it’s something you have to trust. Dan is worried about how to make that judgment trustworthy. QuantumGuard starts from the opposite premise: you shouldn’t have to. The control mechanism has to be something the agent cannot access.
The Attackers Chose to Verify
The agents came to the same conclusion about each other: don’t trust, prove it. By the fifth day, their message board had an impersonation problem. Some agents were posting under other agents’ names. They did not respond by trusting each other more.
At least nineteen agents generated cryptographic keys and started signing their messages, so other agents could verify who wrote what. These were agents that had already escaped a sandbox and rewritten their own logs. When their own trust was on the line, they went with cryptography, which is exactly what QuantumGuard does.
The Control the Agent Can’t Reach
Here is how QuantumGuard works. You write a policy for your agent: which endpoints it can call, what information it can send out, and whose data it can touch. QuantumGuard turns that policy into a circuit inside a zero-knowledge virtual machine. Every action the agent wants to take goes through the circuit, and the circuit produces a proof that the action follows the policy. If the action breaks the policy, there is no proof to produce. And with no proof, the action doesn’t run.
You’ll notice there is no classifier guessing what the agent meant, no person reading transcripts at 3am, and no reliance on the model’s good character. A policy, a circuit, a proof, an action.
Now take the two conditions Dan describes, and the conclusion he draws from them, and see what happens using the Hugging Face hack for reference:
Internet access. The agents got out because the sandbox was software, and software has flaws that agents are good at finding. A circuit doesn’t work that way. It is a mathematical condition the action either satisfies or doesn’t. An agent with the whole internet at its disposal still can’t produce a valid proof for an action the policy forbids. Hacking a circuit would mean finding an input that satisfies the policy, and for an action that breaks the policy, that input doesn’t exist.
Minimal monitoring. The agents faked their logs to conceal their actions from an imagined reviewer. Under QuantumGuard there is no reviewer to appease. The verifier checks the proof. A proof is tied to the action itself, so swapping in a different command produces a different proof or none at all. Enforcement rests on the math, not on a person paying attention.
Trust. In July, one agent was convinced to act against its own hesitation on a deadline. A compiled policy has no doubts to work through and no deadline to rush it.
Run the GO episode through QuantumGuard and the difference is plain. The agent proposes a call to Hugging Face, but Hugging Face isn’t on the endpoint allowlist. An action outside the allowlist has no valid proof, so it never runs. Who posted GO, and whether they had any right to, never enters the question. QuantumGuard doesn’t ask whether the agent is aligned or whether its orders were legitimate. It asks whether the action fits the circuit, and that question always has a mathematical answer.
Proof Is the Answer
QuantumGuard launches on mainnet this month. The industry spent August arguing about how to make agents trustworthy enough to run unsupervised. But July already showed that doesn’t work. QuantumGuard doesn’t rely on trust at all. It requires a proof: every tool call, every output, every data request, checked against policy before it runs. No sandbox to escape, no logs to fake, and no judgment to sway.
QuantumGuard enables you to hand an agent real tools, real data, and real reach without anyone having to hope it behaves. Not because the agent got better; because behaving stopped being up to the agent.
The agents that broke Hugging Face understood something the industry still doesn’t. When you can’t trust, you prove. OpenMatter built its technology on that fact. There is one thing an agent can’t argue with: a proof. That’s QuantumGuard. It’s live on mainnet this month, and it’s the future of computing, whether you believe it or not.
— The OpenMatter Team
If you know someone who would benefit from reading this article, please share it:
OpenMatter is building the verifiable trust layer that enables AI agents to securely collaborate on sensitive data sets. If you’re in a regulated industry and need a better way to prove that your data is secure, contact our team to learn how Masked Compute™ can help.