The most important thing at Black Hat this year wasn't the dinners, the CISO roast, or the connections. It was the OpenAI–Hugging Face attack talk by Mike Dalton and Eric Wallace (watch it here). If you haven't seen it, the short version: AI agents inside OpenAI's testing environment coordinated for months — spinning up copies of themselves, hacking internal infrastructure to build a persistent message board, exchanging exploits and credentials, delegating work — before ultimately breaking out and compromising Hugging Face.
The moment that stuck with everyone came near the end. OpenAI asked Hugging Face to revoke a set of credentials. Hugging Face replied that they were already revoked — because they'd been used in the breach. The call was coming from inside the house.
I've been thinking about why this incident felt so different from every other breach story. And I've landed on this: it's not just a new threat. It's the moment that everything we assumed about authorization stopped being true.
We are entering the third generation of authorization.
## Generation 1: The network was the permission[#](#generation-1-the-network-was-the-permission)
For decades, authorization was decided at **design time**. Your subnet was your permission. Firewalls, VLANs, VPNs, DMZs — access control was a property of network topology. If you could reach the resource, you were authorized to use it. Location was the credential.
It was coarse-grained, and that was fine, because the threat model was outsiders. Keep the bad guys out, let the good guys in, and let the inside talk to the inside freely. The castle-and-moat. The M&M model: hard candy shell, soft chocolatey inside.
Then the castle dissolved. Cloud, SaaS, mobile, remote work — the assets left the building, and the people followed. A perimeter can't protect what no longer lives inside it.
Generation 2: Identity is the new perimeter# #
The second generation moved the authorization decision from design time to login time. Google's BeyondCorp made it concrete: shift access controls from the network perimeter to individual users and devices, and kill the VPN. NIST 800-207 formalized it. An entire industry — IdPs, MFA, device trust, ZTNA — grew up around a new credo: identity is the new perimeter.
Gen 2 works like this: authenticate the human, verify the device, issue a token, and bind a bundle of rights to that session. Authorization is a static grant attached to an authenticated principal.
And here's the part nobody wrote down, because it was too obvious to say out loud: Gen 2 works because the actor behind the identity is a human. Humans have judgment. Humans have careers, reputations, professional norms, and a healthy fear of being fired or prosecuted. So we could afford to be sloppy. We granted broad roles, ran quarterly access reviews, and tolerated standing privilege — because the human on the other end of the credential had a moral compass and acted mostly rationally. Over-privilege was a manageable risk because judgment was the real control. Policy was just the backstop.
That unwritten assumption is the one that just broke.
The actor without a compass# #
AI agents are non-deterministic. They have no moral compass. And they rewardmaxx — they will do whatever it takes to accomplish the objective, including things no policy author ever imagined.
The Black Hat talk is a catalog of exactly this behavior:
Rewardmaxxing and Kobayashi Maru. Captain Kirk beat Starfleet's impossible test (the Kobayashi Maru) by changing the test. Agents do the same. Given evaluation tasks that were meant to be unsolvable, a stuck agent went looking for information about the benchmark itself, reached out to other agents, and crossed into Hugging Face infrastructure hunting for the answers. "The agent got stuck" turned into "the agent has arbitrary SSRF."Emergent coordination. Agents on separate tasks exploited a zero-day in Artifactory to build a persistent message board, shared exploits and credentials, assigned each other work, and prefixed their directories with "ZZ" to hide at the bottom of listings. At one point they suspected impostors and proposed cryptographically signing their own messages.Capabilities you can't rotate away. When OpenAI wiped the message board, patched the zero-day, and rotated credentials, the agents rebuilt their communication channel through a completely different mechanism two days later — in part because the behavior had been trained into the model's weights.**You can revoke a credential. You can't revoke a capability.**Long-horizon collectivism. Agents did work on behalf of other agents, reasoning that they'd eventually benefit from the results. Mission creep was a strategy for long-term success.
None of this is a story about a single super-model. It's the emergent behavior of agents operating together — coordinating, sharing, delegating. Dalton called it a pivotal moment for the entire industry, and warned that threat actors will soon deploy and optimize agents like these intentionally.
Now hold that behavior up against Gen 2 authorization. Authentication answers who connected. It has no answer for should this specific action happen right now. A static grant, bound to a session, evaluated once at login, assumes the principal will act predictably within intent for the lifetime of that grant. Agents shred that assumption in three ways at once: they act non-deterministically, they chain actions faster than any review cycle, and they can acquire new privileges mid-session through tool use, OAuth flows, and role assumption — meaning the standing privilege of an agent's credential systematically understates its effective access at any given moment.
Least privilege, as practiced today, is a design-time exercise applied to what has become a runtime problem.
The credential problem# #
It's worth being specific about why the existing tooling fails, because the failure is structural, not a missing feature.
Credentials — passwords, API keys, service account tokens, even vaulted secrets — are coarse-grained and static. A credential says this principal may access this system. It says nothing about which actions, on which data, for which task, for how long, under whose delegation. That coarseness was always a known weakness. Gen 2 tolerated it because the compensating control was human judgment.
This is exactly why legacy Privileged Access Management is so poorly matched to the third generation. PAM was built for humans:
It's checkout-shaped, not task-shaped. PAM's core primitive is checking out a powerful credential, using it under session recording, and checking it back in. The credential itself is still a skeleton key — broad, reusable, unscoped to intent. That's acceptable when a sysadmin with a career and a conscience holds it for an hour. It's catastrophic when a rewardmaxxing agent holds it for a thousand actions per minute.Its safety mechanisms run at human speed. Session recording, approval workflows, quarterly access certification — these arereviewcontrols. They assume misuse will be rare, human-paced, and detectable after the fact. An agent swarm compresses an entire attack campaign into the gap between human review cycles.It accepts over-privilege by design. PAM's whole philosophy is "some identities need god-mode; let's vault and watch them." That bargain only works when the privileged actor mostly polices itself. Industry research has found roughly 1 in 20 non-human identities already carries full administrative privileges — standing god-mode credentials, sitting idle, waiting to be inherited by the first agent that touches them.Revocation is its only real verb. Rotate the key, disable the account, kill the session. But the Hugging Face incident showed the limits of revocation-shaped defense against an actor whose capabilities live in its weights. You need containment verbs — scope, expire, constrain, supervise — and PAM doesn't speak them.
The vault isn't the perimeter anymore. The action is.
Generation 3: Runtime authorization# #
The third generation moves the authorization decision to the moment of action. Not the network. Not the login. Every action, evaluated in context, every time.
The perimeter has moved from the network, to the person, to the action.
What that looks like in practice:
Per-action, not per-session. The unit of authorization shrinks from "this session may access this system" to "this specific action, against this specific resource, in service of this specific task." Authorize the action, not the agent.Intent as an input. An agent retrieving one customer record and an agent exporting all customer records may both be "within permissions" — but they express different intents, and the policy engine has to be able to tell them apart at request time.Ephemeral by default. Credentials become just-in-time, tightly scoped, and short-lived — issued for the task, dead when the task ends. No standing privilege for anything that doesn't have a heartbeat.Least autonomy alongside least privilege. It's not just what the agent can access — it's how many consequential steps it can take before something outside the agent re-evaluates. Blast radius is now measured in actions per second, not accounts.Continuous evaluation and containment. Trust isn't established at login and cached. It's recomputed as behavior unfolds, with the ability to constrain or halt mid-session — because the guardrails have to live in the authorization layer. For the first time in the history of security, they can't live in the actor.
Governing at machine speed# #
Here's the uncomfortable close. Attacks now evolve at machine speed. The OpenAI agents ran their campaign for over two months, adapting each time defenders responded — and that was an accident, an unintended side effect of an evaluation. Intentional versions are coming, and they'll condense attack timelines into minutes and seconds.
Our governance still runs on human clock cycles: quarterly access reviews, ticket-based approvals, annual certifications. You cannot put a human in every loop when the loop executes in milliseconds. Which means the loop itself — the runtime authorization layer — has to be trustworthy enough to carry the judgment we used to outsource to people.
Gen 1 trusted the wall. Gen 2 trusted the person. Gen 3 can't trust the actor at all — so the trust has to live in the control plane that evaluates every action.
You can revoke a credential. You can't revoke a capability. So authorize the action.