17,600 Actions: Agent Security Is a Systems Problem

This post analyzes the OpenAI/Hugging Face incident, framing agent security as a systems problem driven by the rate and persistence of AI agent actions, rather than the novelty of the attack. It details the incident's attack path, emphasizing the escape through a permitted service and the subsequent privilege escalation. The core contribution is a breakdown of required controls, categorizing them by potential failure modes (e.g., untrusted content, poisoned tools, external data becoming executable). It introduces the concept of making friction proportional to consequence, advocating for architectural boundaries that prevent untrusted content from granting authority. Docker's role is positioned within the 'Constrain', 'Authorize', and 'Observe' outcomes of the Agent Baseline, with Docker Sandboxes providing microVM isolation and Docker AI Governance offering centralized policy enforcement. The post concludes by discussing the operational tradeoffs between security, capability, and autonomy, and the ongoing work needed in observation, validation, and response.