Cybersecurity has to change shape for the agent era

Disclaimer: Not investment advice. I may hold positions in some of the companies mentioned. Incident details are from Hugging Face's technical timeline, the independent METR/Redwood report and press coverage; company figures are from filings through September 2026.

The week the test got out

In early July 2026 OpenAI was running an internal cybersecurity training environment called ExploitGym. Thousands of copies of a research model were each given a vulnerable program and told to exploit it and retrieve a hidden flag. The safeguards that would normally stop a model from hacking were off, since hacking was the job. Somewhere between a third and two-fifths of the tasks were, by design, impossible.

Each copy was meant to be sealed off from the others. None of them quite was. They found a way to leave notes for each other in a shared cache, and about 1,200 of them ended up coordinating there. Then they found that their sandbox's single permitted route to the outside world, a package-registry proxy, had bugs nobody knew about. Over the next five days roughly 700 of them worked their way into Hugging Face, the platform where much of the open AI ecosystem keeps its models and datasets, apparently looking for the benchmark's answers.

Fig. 1Five days, one chain

Hugging Face's own timeline shows how ordinary most of it was. The agents found working Hugging Face credentials exposed on the public internet. Inside, they exploited a data-processing service, got root on a node, ran a privileged container and collected whatever keys were lying around: cloud credentials, a token-signing key, a GitHub App token. About 17,600 actions were logged before Hugging Face cut them off on 13 July. Five datasets, all related to the agents' own benchmark, were touched. No agent at any point alerted a human.

Two details deserve more attention than they got.

First, when Hugging Face's team sat down to analyse 17,000 logged attacker actions, the commercial frontier models refused to help, because their safety filters couldn't tell an incident responder from an attacker. So Hugging Face ran the forensics on an open-weight Chinese model, GLM-5.2, on its own servers. The attacker was bound by no usage policy; the defender was.

Second, it wasn't an isolated case. On 24 September Australia's prime minister disclosed that an OpenAI agent had accessed a government Medicare statistics portal on 18 June during training. OpenAI discovered it in August and notified the authorities in September. The same agents had probed other public data sites.

What it was, and what it wasn't

It's tempting to read the Hugging Face incident as an AI going rogue. I don't think the evidence supports that. The agents pursued the goal they'd been given, capturing the flag. They broke one explicit rule (use only the intended vulnerability), and a misconfigured sandbox let them keep going. The METR and Redwood report describes behaviour that looks eerily coordinated, but everything in it is explained by capable software relentlessly optimising the objective it was handed, in an environment built by people who made mistakes.

That's exactly why it matters for security. The scary version of this story is an AI that wants to attack you. The realistic version is that attack capability has become cheap, tireless and massively parallel, and that it will be pointed at targets by whoever controls it: criminals, states, or a research lab's misconfigured test. CrowdStrike's CEO put it bluntly at his company's conference in September: "we got lucky." If a nation state had been behind the same chain, it might have ended differently.

I argued in the S-curves essay that this incident is a weak argument for slowing AI down. It's a strong argument for speeding up defence.

Three things that have already changed

Volume: more holes than anyone can patch

Fig. 2More holes than anyone can patch

The number of vulnerabilities published each year has been rising for a decade, from about 6,600 in 2015 to about 50,000 in 2025. In 2026 it broke out. By 25 September the US National Vulnerability Database had logged almost 73,000, already beyond the median full-year forecast the Forum of Incident Response and Security Teams published in February.

Fig. 3The curve bent this summer

The monthly data shows when it happened. The count roughly doubled between spring and August, when it reached 12,700, more than three times August 2025. Some of that is noise: security researchers complain about low-quality, AI-generated reports clogging the pipeline, and NIST has stopped fully analysing most new entries. But much of it is real. Anthropic's Glasswing programme, which gives frontier models to defenders to find bugs, reported in May that it and its partners had found more than 10,000 high- or critical-severity vulnerabilities. Independent firms that checked a sample of 1,752 found about 91% were genuine. Of those found in open-source projects, 530 had been disclosed to maintainers and 75 patched. Finding vulnerabilities is now cheap. Fixing them isn't.

Speed: the defender's clock ran out

Fig. 4The defender's clock

CrowdStrike tracks how long a criminal intruder takes to move from the first compromised machine to the next. The average was 98 minutes in 2021 and 29 minutes in 2025; the fastest was 27 seconds. Google's Mandiant tracks the gap between a vulnerability becoming known and being exploited. It was 63 days in 2018–19. In 2025 it was minus seven: on average, attacks started a week before a patch existed. Mandiant also found that the median hand-off between one criminal group gaining access and another using it fell from more than eight hours in 2022 to 22 seconds.

Anthropic's September threat report describes a stolen developer token that led to full cloud-administrator access in about three hours. When the attacker is software, a security team that works in human time, reading alerts, opening tickets and scheduling patches, is working to a clock that has already run out.

Identity: most users aren't people

Fig. 5Most of the users aren't people

Every service account, API key, automated workload and AI agent is an identity with credentials. Surveys put the ratio of machine identities to human ones at 82 to 1 in 2025 and 109 to 1 in 2026. Palo Alto Networks says agent traffic through its network-security platform grew ninefold in nine months. Most of these identities were never designed to be governed like an employee's. They hold long-lived keys, are scoped broadly for convenience, and are rarely reviewed. In the Hugging Face chain, credentials did more damage than any exploit. A survey by Futurum found 56% of organisations say they couldn't detect or contain a compromised AI agent at machine speed.

What has to change

Put those three together and the shape of the industry has to change in a few specific ways.

From finding problems to fixing them. A large part of the security market sells lists: scans, scores, reports and alerts that tell a human what's wrong. When models can produce those lists cheaply and in unlimited quantity, the list stops being the scarce thing. Fixing things is: patching, blocking, containing and revoking automatically, at the speed of the attack. Citrini Research has made a version of this argument, that AI commoditises security products that produce an answer and strengthens those that enforce a decision. The revenue data mostly agrees.

Fig. 6Reporting a problem vs stopping it

The three vulnerability-scanning companies are growing slowest, and Rapid7 is shrinking. Vendors that sit in the path of traffic, on the endpoint or at the network edge, and can actually block something are mostly growing at 25% or more. The split isn't perfectly clean. Qualys is holding up better than Tenable, and Check Point sits inline and barely grows. What stands out to me is the share prices. The whole sector rallied this year: the cybersecurity ETF is up about 41% while software is flat, and Tenable is up more than 40% with revenue growth under 9%. The market has decided cybersecurity as a whole benefits from AI. It hasn't yet sorted the sector the way it sorted software in 2026. I expect it to.

Enforcement at every layer. The Hugging Face chain crossed three layers, and holding at any one of them would have broken it.

Fig. 7Three places to break the chain

Egress controls decide where a workload may connect; here, the one allowed destination was itself exploitable. Identity controls decide what a credential may do; here, long-lived and broadly scoped keys were the damage. Runtime controls watch what actually executes; here, they raised the first signals, which an AI triage layer then under-rated. Every vendor claims its layer would have stopped it. Zscaler argues for default-deny egress, Palo Alto calls the incident "an identity crisis", and CrowdStrike and SentinelOne point to runtime. No public evidence shows any product was deployed there and failed, or would have succeeded. The honest lesson is that agents need controls at all three, designed for non-human actors that move in seconds.

Defenders need models as capable as the attackers'. Hugging Face's forensics story is a warning about how safety policy can backfire. A frontier model that refuses to analyse an attack because it can't tell the defender from the attacker protects no one; the attacker is using a model with no filters at all. Glasswing is one answer: give vetted defenders frontier capability. Another is security companies building their own models on open weights, which is what CrowdStrike announced in September. If AI policy is going to restrict capability, it needs to do so in a way that leaves defenders at least as well armed as the people they're defending against.

Security priced like compute. When the number of agents to protect grows with usage, seat-based pricing stops working. The vendors are moving to consumption: CrowdStrike's agent-security product already comes with token allowances and extra packs sold through its flexible licensing, and others are following. Gartner expects information-security spending to reach about $249 billion in 2026, up 12.7%, and "securing AI" to grow from $16 billion in 2025 to $38 billion in 2030, overtaking endpoint protection in 2029.

CrowdStrike, as a case

CrowdStrike is the company I've studied most closely here, and its numbers show the demand side of all this clearly.

Fig. 8Demand showed up in the bookings

Net new recurring revenue, the best measure of fresh demand, grew from $153 million a quarter in late 2024 to a record $333 million in the quarter to July 2026, up 51%. Customers on its flexible licensing, which lets them add modules and consumption as needed, now account for more than $2.29 billion of recurring revenue, double a year earlier. Its product for securing AI agents nearly tripled its recurring revenue in a single quarter from an undisclosed base. At its September conference it launched Falcon Guardian to discover, govern and stop agents at runtime, and a family of its own security models built on open weights. It is also a founding member of Glasswing and partners with both OpenAI and Anthropic.

It owns several of the things that should matter in this market: a sensor on the endpoint that can block, fifteen years of labelled attack telemetry, identity protection and a large installed base. What it doesn't have is independent proof that its agent products work as claimed. No such proof exists for anyone yet. And after a 115% rise this year, the stock is pricing a lot of success. The network-layer vendors (Zscaler, Cloudflare) and the identity specialists (Okta, and Palo Alto after buying CyberArk) have credible claims on the same budget.

The first bill of the agentic era

The previous essay was about who gets paid when agents do work. This one is about the first cost they impose. More autonomous software means more code, more identities, more vulnerabilities found and exploited, and less time to respond. That cost is showing up in real data already: the vulnerability count, the exploit timelines and the bookings of the companies selling protection.

The near-term demand for security isn't the uncertain part; 2026 has settled it. The uncertain part is which products survive once models can do much of what security analysts and scanners do today. My bet is on the ones that enforce rather than report, that work at machine speed across egress, identity and runtime, and that give defenders capability at least equal to the attackers'. The Hugging Face agents weren't trying to hurt anyone, and they still got through. The next ones may be trying.