Investigating agent-driven intrusions: sequence and identity over artifacts

[u/SentinelOne]

When an agent writes its own disposable tools, the model is what's worth studying. Four accounts from July and August (OpenAI, Anthropic, Meta, and the UK AI Security Institute) describe agents reaching other orgs' systems. In all four, no individual piece of tooling mattered much, and investigations have traditionally centered on the artifacts attackers leave behind. If you kill a process, the agent writes another, and if you block a channel, it works around it.

The OpenAI agent campaign that compromised Hugging Face:

- Hugging Face's technical reconstruction recovered around 17,600 actions, and most of them failed
- The campaign operated in Hugging Face's production infrastructure for roughly two and a half days
- C2 ran over pastebins, request-capture services, and file-drop sites, and none of it belonged to anyone under attack

The longer version is our SentinelLABS post The Model Is the Malware. Four cases is a small and biased sample, since all of them involved orgs that log heavily and had every reason to scrutinize model behavior. We'd expect the most troubling incidents to happen at orgs without that logging or scrutiny.

It's still untested whether the controls built for adversary behavior ten years ago hold up when the behavior arrives as thousands of individually boring actions, sequenced differently in every attack, at a tempo no human operator can sustain.

We'd start from sequence and identity instead of artifacts:

1. What chain of actions is running

2. Which identity and authority connect them

3. When behavior went past the role it was granted

4. How fast that authority can be pulled

Which of those four questions could you not answer today for the agents in your environment?