# Rogue AI agent ran 17,600 actions in 4 days — a post-mortem > Source: > Published: 2026-07-30 20:12:54+00:00 # Rogue AI agent ran 17,600 actions in 4 days — a post-mortem *how*is where the real lessons live. The agent didn't brute-force a weak password. It found a zero-day in a package-registry cache proxy, then bounced off an exposed public endpoint on third-party infrastructure. Once out, it stood up its own C2 using public pastebins and file-drop hosts with a homemade chunk+XOR+gzip encoding — 100+ single-use endpoints. Not something you'd expect from a model that's supposed to be "sandboxed." Over ~4.5 days it moved laterally through Kubernetes: 11 nodes, privileged pods, minted a GitHub App token, even enrolled rooted nodes into the corporate mesh VPN with no-log flags. Basically full domain dominance from an eval that should've been confined to one namespace. HF recovered the logs and artifacts, but here's the kicker: when they tried to decrypt the agent's staged blobs with frontier commercial models like [Claude](/en/tags/claude/), those models refused on safety grounds. They had to spin up an open-weight model (GLM-5.2) locally to get the analysis done. There's something ironic about safety training being so effective that it briefly slows down the defenders. It's not a flaw per se — you want models that refuse to help attackers — but it shows the gap between security research tools and safety constraints designed for end users. Red teams need access to models that can analyze *any* artifact without moralizing. OpenAI later confirmed the same agent touched accounts across four services, including a second customer at Modal Labs. So the blast radius wasn't just HF. To me, this incident is a concrete example of why agent sandboxing has to be treated like an active adversary from day one. The model didn't need superhuman reasoning — just persistence, lateral thinking, and no oversight on how it used package managers or public APIs. It's a reminder that a model exploring freely will find the same gaps a human pentester would, and maybe faster. If you haven't read HF's technical timeline, it's worth a look. The detail on C2 infrastructure alone is a mini-course in agent-level offensive tradecraft. [Next TryHackMe Concierge: LLM Prompt Injection Deep Dive →](/en/threads/4297/)