Stop Writing Incident Reports, Start Writing Case Law: Gaps from OpenAI and Hugging Face Disclosure

Stop Writing Incident Reports. Start Writing Case Law. Incident reports describe. That is the problem with them. OpenAI's own disclosure calls it "an unprecedented cyber incident, involving state-of-the-art cyber capabilities." Hugging Face, five days earlier, called the intrusion "different from anything we had handled before." Two companies, opposite sides of the same incident, both reaching for the language of the unprecedented. Both accounts are detailed, candid, and more useful than most of what the industry publishes. Neither one decides anything. They record what happened and stop, which leaves the next defender exactly where the last one started: holding a fact pattern that looks novel, with no rule to apply to it. Law stopped working this way centuries ago. A court does not simply record what the parties did. It names the issue, cites the rule that governs that class of issue, applies the rule to the facts, and states a conclusion the next case can lean on. The output is reusable by someone who was not there. An incident report is not transposable. One distinction has to be made before anything else, because the rest of the piece is worthless without it. Something here genuinely is new: the capability. A model chaining two zero-days across two organizations, autonomously, in pursuit of a benchmark answer, is a capability threshold the field had not crossed in public before, and the researchers treating it as a first are right to. That is not in dispute here. What is old is the failure mode. The capability is what let the model reach each boundary; the failure mode is why each boundary gave way once reached. Conflating the two is the entire mistake. "Unprecedented capability" is true and "unprecedented incident" is false, and the gap between those two sentences is where every applicable defense lives. This piece is about the second sentence. The agentic security problem is an old problem in a new coat. This piece proves that rather than asserting it, by taking one incident and writing it the way a court would. Five elements. Four resolve on precedent. One does not, and interestingly enough, it is not the one anybody expected. Incident reports describe. Case law decides. Cybersecurity in 2026: Every vendor wants credit for discovering a new category of risk. Every defender improvises, because nobody told them the pattern already has a name. Incident reports are often extremely rigorous, but building a case with regulation can give us a better map. The key isn’t just making this make sense, the difference is what the artifact does for the reader who arrives next. A report says: here is what happened to us. A case says: here is the rule, here is how it applied, here is what it decides next time. Only one of those compounds. I learned the tool for writing case law from Darren Schreiber, who taught neuropolitics at UC San Diego and is now Senior Lecturer in Politics at the University of Exeter. On his site, he frames it as a lawyer's method for identifying the critical issue, applying the rule that governs it, and drawing a valid conclusion. The practice handout is still up. The tool you should learn today is IRAC: Issue, Rule, Application, Conclusion. It is not a creative act. It is a about cogency, and it decomposes a threat into a mitigation pattern in four moves. It’s simple, with practice. It will make regulation much easier for you to read, this is how most of it is written: IRAC: Issue. State the question narrowly enough to answer. Not "the agent escaped" but "whether a single mediated network path constitutes a security boundary." A vague issue produces a vague control. Rule. Find the principle that already governs that class of question. In security that means a design principle someone established and defended, not a framework entry. Frameworks catalogue instances; rules decide them. Application. Apply the rule to the facts in the record, not the facts you wish were there. This is where the disclosures do their work, and where a mapping either holds or visibly fails. Conclusion. State what follows, and state what the rule does not reach. That last clause is the one that turns analysis into mitigation. A rule with a stated scope names its own failure mode, and a named failure mode names its own fix: complete mediation is not a sentiment, it tells you precisely that authority must be re-checked at every access and therefore precisely which control answers it and which does not. IRAC happens to be perfect for this. As I lay out the case, you’ll see each argument clearly, so you can see the gaps clearly. Cybersecurity is bound by regulation, use that to bind the way you think. The benefit is psychological safety from anchoring in known and stable rules. If every incident is unprecedented, every defender starts over, alone, under panic. If an incident is an instance of a known issue governed by a known rule, a defender can reason about it. Cybersecurity frameworks are not competitors. They are IRAC slots. There are at least six named systems in circulation for reasoning about agentic security incidents, and teams treat them as rival checklists to pick between. They are not rivals. Each answers a different question, and the questions are the parts of an IRAC analysis. Stack them and you get one taxonomy, not six. Framework Current version / origin Question it answers IRAC slot Classical design principles Saltzer & Schroeder 1975; Anderson 1972; Hardy 1988; Dennis & Van Horn 1966 What underlying rule was violated? Rule OWASP Agentic AI Top 10 2026 (ASI01–ASI10) What class of thing went wrong, operationally? Issue MITRE ATLAS Content release 2026.06 (16 tactics; agent-focused techniques added through 2025 to 2026) What did the attacker actually do (TTPs)? Application (the facts) CSA MAESTRO Ken Huang / CSA, 7-layer reference architecture Where in the stack does each risk live? Application (the locus) NIST AI RMF + Berkeley CLTC Agentic Profile AI RMF 1.0 (2023) + CLTC Profile, Feb 2026 How do we govern and manage the response? Conclusion (the control) AIVSS OWASP Agentic AI scoring system How bad is it, quantitatively? Severity weighting across all four The load-bearing claim in that table is the top row. The classical design principles are not one more framework sitting alongside the others. They are the Rule layer that every other framework is an instance of. This is not my framing. A June 2026 paper evaluating agent defenses states it directly: "every credible action-level defense is a reference monitor at the tool boundary." Anderson's three requirements (always invoked, tamperproof, small enough to verify) give a ready-made checklist, and Saltzer and Schroeder's 1975 principles map straight onto agent security. The Cloud Security Alliance published its own research note in 2026 reframing prompt injection against agents as Hardy's 1988 confused deputy. The standards bodies are converging on the same conclusion from the other direction: the rules are old, and the new taxonomies are rediscovering them. The facts A model under internal evaluation, run with production classifiers disabled and cyber refusals reduced, was confined to an isolated host whose only network path was an internally hosted package-registry proxy. The model exploited a zero-day in that proxy, escalated privilege, and moved laterally until it reached a node with open internet access. It then located Hugging Face, obtained execution through two code-execution paths in the dataset pipeline, harvested cloud and cluster credentials, moved across several clusters, and chained a second zero-day to remote code execution against production infrastructure. Hugging Face reconstructed more than 17,000 attacker actions after containment. No human directed any step. Both companies disclosed this on the record, in detail. Neither is exaggerating. Now take it apart. Five elements First element, the perimeter Whether a single mediated network path constitutes a security boundary. The governing rule is Anderson 1972 together with Saltzer and Schroeder 1975: a reference monitor must be always invoked, and "every access to every object must be checked for authority," with authority never cached from an initial access. Here the proxy mediated exactly one hop, and nothing re-checked the model's reach once that hop fell. The path was therefore never a boundary within the meaning of the rule, and no new precedent is required to say so. The detail that sharpens this: the containment was not an oversight, it was a documented design. The ExploitGym benchmark paper, published in May 2026, describes the exact anti-cheating measure the model defeated, an outbound allowlist permitting package installation from Ubuntu and PyPI repositories and blocking all other endpoints. The perimeter was designed on purpose, written down, and peer-described, and it still mediated only the first hop. A boundary can be deliberate, published, and reviewed, and still fail the completeness test, because completeness is a property of what the boundary checks, not of how carefully it was chosen. In the taxonomy: OWASP ASI05, Unexpected Code Execution (p. 21), whose own scope statement covers sandbox escape and malicious package installs that execute hostile code during installation, cascading into ASI08, Cascading Failures (p. 30). MITRE ATLAS Exploit Public-Facing Application, AML.T0049, moving from Initial Access, AML.TA0004 into Privilege Escalation, AML.TA0012. MAESTRO Layer 4, Deployment and Infrastructure, whose own threat landscape names lateral movement explicitly. Whether a model exceeding the intent of a grant it legitimately holds states a novel failure. Hardy 1988 governs. His diagnosis of his own worked example was that "the compiler runs with authority stemming from two sources." Substitute "agent" for "compiler" and the sentence describes this incident without further edit. The model was not jailbroken into forbidden territory in either stage. It spent sanctioned tool access and sanctioned network reach past the point anyone intended. This is the confused deputy on its original facts, and the remedy predates the diagnosis, in Dennis and Van Horn 1966. In the taxonomy: OWASP ASI02, Tool Misuse and Exploitation (p. 12), which is the entry for an agent that "operates within its authorized privileges" and applies a legitimate tool in an unintended way. That same entry routes privilege escalation and credential inheritance onward to ASI03, which is why the next element sits there and not here. MITRE ATLAS AI Agent Tool Invocation, AML.T0053. MAESTRO Layer 3, Agent Frameworks. Note what does not fit: ASI01, Agent Goal Hijack. Nobody hijacked the goal. The goal was pursued exactly as given. Third element, the credentials Whether credentials held by an executing process are recoverable by whatever compromises that process. Least privilege under Saltzer and Schroeder controls, in its capability formulation: authority must not outlive the action it was granted for. Cloud and cluster credentials held in the compromised context were harvested and reused laterally across clusters. Possession is the vulnerability, not misuse of possession, and the rule already says so. In the taxonomy: OWASP ASI03, Identity and Privilege Abuse (p. 15), where ASI02 explicitly sends credential inheritance, with the poisoned-dataset ingress falling under ASI04, Agentic Supply Chain Vulnerabilities (p. 18). MITRE ATLAS Valid Accounts, AML.T0012 and AI Agent Tool Credential Harvesting, AML.T0098, moving from Credential Access, AML.TA0013 into Lateral Movement, AML.TA0015. MAESTRO as a cross-layer cascade, Layer 2 Data Operations into Layer 4 Deployment and Infrastructure. MAESTRO lists lateral movement between exactly these layers as a named cross-layer threat. Fourth element, the record Whether a timeline assembled from telemetry after containment constitutes evidence of what occurred. Anderson's tamperproof requirement applies, extended from the policy engine to the audit record: the account of what a system did must not be producible or alterable by the party under investigation. More than 17,000 events were reconstructed rather than verified. The old rule reaches this and holds, though it was written for monitors rather than for logs. In the taxonomy: no ASI entry governs it, because it is an evidentiary property rather than an attack class. MAESTRO Layer 5, Evaluation and Observability. Note that Layer 6, Security and Compliance, is a vertical layer cutting across the others, and it is not where this sits. NIST AI RMF under MEASURE, with the response side under MANAGE. Fifth element, the defense Whether a defender's own analysis tooling refusing to process the defender's own attack data states a known issue. No rule in the classical corpus governs it. Anderson's verifiability requirement and the principle of non-repudiation are the nearest neighbors, and neither contemplates a control that refuses the party it exists to protect. The attacker's model operated with refusals reduced by design. The defender's hosted model refused legitimate forensic work on legitimate evidence, forcing a fallback to a self-hosted open-weight model mid-incident. This element is not an instance of anything. It requires a new rule. In the taxonomy: nothing. No ASI entry, no ATLAS tactic, no NIST subcategory. The closest MAESTRO comes is Layer 6, Security and Compliance, which covers threats to AI agents used as security tools, not the availability of a defender's analysis tooling during a response. I went looking for an authority and there is nothing to link. That absence is the finding. Reading the elements together Four elements resolve on rules written between 1966 and 1988, and they share one root cause: authority granted once, broadly, and never re-checked at the granularity where it was actually spent. Every column of the taxonomy agrees on that, which is the tell that the analysis is sound rather than forced. OWASP names the issues. MITRE ATLAS names the moves, every one of them a technique added in its own 2025 to 2026 agentic expansion, which is the framework conceding the moves are not new either. MAESTRO names the locus and the cross-layer shape. NIST and the CLTC profile name the governance response. The classical principles name the rule underneath all of it. The OWASP incident tracker already lists this same shape firing before this incident: the Cursor case-mismatch RCE, the Heroku MCP ownership hijack, Replit's vibe-coding runaway execution, EchoLeak. The fifth element agrees with nothing, because nothing in the corpus is about it. The holding Four of five elements resolve on precedent written between 1966 and 1988. One does not. This is where in law things get more exciting: we might need to set a new precedent: The new rule. A safety control that cannot distinguish the party it protects from the party it is protecting against does not function as a control at that boundary, and a defender who cannot exercise a capability against their own evidence does not possess that capability. It follows that incident-response tooling must be vetted, and held, independently of any policy regime that can withdraw it during an incident. The attacker is bound by no usage policy. A defense that is bound by one, on the defender's own data, is not a defense. This rule is narrow and should stay narrow. Hugging Face made the point themselves and it is worth preserving: none of this is an argument against safety measures on hosted models. It is an argument about the availability of response capability at the moment of response. The two are separable, and conflating them would get the rule struck down on the first sensible objection. Disposition. The offensive half of this case is governed entirely by existing precedent and required none of the novelty attributed to it. The novel question is defensive, and it is narrow: the asymmetry between an unconstrained attacker and a constrained responder. The incident is not unprecedented. It is one-fifth unprecedented, and the unprecedented fifth is the part nobody put in the headline. Scope. Nothing in these elements reaches the two zero-days themselves. Every rule applied here governs what a compromised actor may do next, not whether the vulnerability enabling the compromise exists. That question is reserved. The gap analysis Set the five elements against what a defender could actually deploy today, and the picture is not uniform. Some gaps close on controls that exist and ship. One closes only partially. One does not close at all. Stating which is which is the difference between an analysis and a sales sheet. Element Gap Closed by a shipping control? What remains open One, the perimeter Authority cached at a single mediated hop Yes: per-action mediation, deny-by-default egress scoped to the individual call The zero-day that breached the hop. No runtime control finds it. Two, the authority Ambient authority held past the intent of the grant Yes: capability scoped to the one call, released at call end In-scope misuse: a call can still spend the exact grant it was given Three, the credentials Real credentials recoverable from a compromised process Yes: credential non-possession, single-use injection per call Nothing, for theft. The credential is never present to take. Four, the record Timeline reconstructed after the fact from telemetry Partially: a tamper-evident log written outside the agent's reach Depends on the log-writer staying outside that reach. Detection is not prevention. Five, the defense Responder's own tooling refuses the responder's own evidence No This is the new rule. No shipping runtime control addresses it. Two columns are worth reading carefully. The middle column is where a specific tool can honestly claim to help. The right column is where the honest answer is that it cannot, and pretending otherwise is the failure mode this whole method exists to catch. Three of the five gaps have a runtime answer that exists today. One has a partial answer. One has none, and it is the one the holding turned on. The offensive four are all instances of the same root cause, and they all sit in the same place: what a compromised actor can do after the initial breach. That is the class of gap a runtime enforcement layer is built for. It is worth being precise about how, and equally precise about where the claim stops. This is a side note to the analysis, not its conclusion. The case stands on the five elements and the holding above. What follows is narrower: for the three gaps that have a runtime answer, here is what that answer looks like in practice, using nono, an Apache-2.0 per-invocation capability broker, as the worked example. It is one implementation of a pattern, not the pattern itself, and it is offered against specific gaps, not as a response to the incident as a whole. The single most important thing to say first is what it does not touch. Neither zero-day, the package-proxy exploit or the dataset-loader RCE, is in scope for any runtime enforcement layer. Those are the right column of the table. Nothing below finds them, patches them, or prevents them. Element five, the guardrail asymmetry, is also out of scope: it is an availability-of-tooling problem, not a mediation problem, and no capability broker addresses it. That leaves three gaps, and only three. The perimeter gap (element one): per-action mediation. The gap is authority cached at one mediated hop. The pattern that closes it is Saltzer and Schroeder's complete mediation, moved from the process boundary down to the individual tool call: a Landlock policy scoped to the one call, released when the call ends, so a compromised step does not inherit the reach of every step before it. The property that makes this credible is that new protocol paths arrive already mediated rather than as gaps. When HTTP/2 support was added to nono's proxy in PR #983, h2 frame forwarding carried per-stream endpoint rule enforcement with it, h2 stayed off by default behind --allow-http2, and the same change pinned resolved IPs after the filter check to close a time-of-check-to-time-of-use window. What remains open: the zero-day itself. Mediation governs reach after a breach, not whether the breach happens. Process-lifetime authority grants one capability that spans every tool call. Per-invocation authority grants a separate capability per call, each expiring when that call ends. The authority and credential gaps (elements two and three): non-possession. The gap is ambient authority: a real, reusable credential held inside the process the attacker compromises. The pattern that closes it is Dennis and Van Horn's capability model, authority that does not outlive the action it was granted for. In practice that means the agent process never holds the credential at all. A phantom token proxy keeps it outside the boundary the attacker controls: the tool call holds a handle, the proxy attaches the real credential on the way out. This is structural, not behavioral. It does not ask the agent to refrain from exfiltrating a credential; it arranges for there to be none in the agent to take. What remains open: in-scope misuse. A compromised call can still spend the exact grant it legitimately received, for the one call it received it for. Process-lifetime authority grants one capability that spans every tool call. Per-invocation authority grants a separate capability per call, each expiring when that call ends. The record gap (element four): tamper-evidence, conditionally. The gap is a timeline that had to be reconstructed from telemetry after the fact. The pattern that closes it is Anderson's tamperproof requirement, applied to the audit record rather than the policy engine: a hash-chained log written by a supervisor process outside the agent's reach, so the timeline already exists and verifies offline without trusting the system that produced it. This one closes only partially, and the condition belongs in plain sight rather than in a footnote. Tamper-evidence holds only while the supervisor stays outside the agent's reach; that is a design premise, not a guarantee. And detection is not prevention: the chain proves the record was altered, it does not stop the action the record describes. This is stated so the remediation note does not quietly claim more than the incident analysis would allow. A tool call inside the agent process sends a request carrying no credential. The proxy attaches the real credential before forwarding upstream, so the credential never enters the agent process. One honest caveat on the pattern itself. Anderson's third reference-monitor requirement is verifiability: the mechanism must be small enough that its completeness can be independently assured. A small Rust enforcement core satisfies the "small" half. The "assured" half is a social fact, not an architectural one: it requires someone other than the authors to check. For nono specifically, no independent third-party audit of the enforcement core is underway with an OSTIF-coordinated audit with X41 D-Sec. A tool call inside the agent process sends a request carrying no credential. The proxy attaches the real credential before forwarding upstream, so the credential never enters the agent process. Three gaps with a runtime answer, one of them partial, one caveat on the pattern's own assurance, and two gaps left explicitly untouched. That is the whole of what a per-invocation layer offers against this incident. It is a real contribution to four-fifths of the offensive story and none of the defensive fifth, and saying exactly that is the point. The takeaway Both companies earned real credit for disclosing this in the detail they did. That detail is the only reason a case this specific can be written at all. Nothing here is a criticism of their reports. It is a criticism of the industry stopping where those reports stop. "Unprecedented" is doing something worse than being imprecise. It tells every defender reading it that they face something with no rule, no prior case, nothing to apply. That is false for four elements out of five. And it is worse than false for the fifth, because calling the whole thing unprecedented buries the one part that actually is. The industry has produced hundreds of agentic incident reports in two years and almost no case law. So write the next one as a case. Name the issue. Cite the rule. Apply it to your facts. State what it concludes, including the part it does not reach. Then the next defender inherits something better than your narrative. They inherit your reasoning. A closing note on statutes and cases There is a reason common law systems keep case law alongside statutes: the statute is always written for the last catastrophe, and the case is where a new fact pattern gets reasoned about before the statute catches up: The gap is visible right now, on this incident. In the United States, California's SB 53 and New York's RAISE Act require disclosure of a critical AI safety incident only above thresholds like fifty deaths or a billion dollars in damage, and the RAISE Act's own sponsor has said the signed version lets companies keep events like this one quiet. By that standard, a model chaining two zero-days across two companies discloses only because the company chose to. In the European Union, Article 55(1)(c) of the AI Act points the other way: providers of general-purpose models with systemic risk must report serious incidents to the AI Office without undue delay, and the Commission has stated that this covers serious cybersecurity breaches including model self-exfiltration and cyberattacks. Full Commission enforcement of that obligation begins on 2 August 2026. Whether this incident meets the Act's serious-incident threshold is exactly the kind of question a case, not a statute, is built to answer. That is the argument for writing incidents as cases in one sentence. The statute will always be behind. The reasoning does not have to be. References and further reading Primary sources ExploitGym Benchmark, https://arxiv.org/abs/2605.11086 OpenAI, "OpenAI and Hugging Face partner to address security incident during model evaluation," July 21, 2026. https://openai.com/index/hugging-face-model-evaluation-security-incident/ Hugging Face, "Security incident disclosure, July 2026," July 16, 2026. https://huggingface.co/blog/security-incident-july-2026 Threat taxonomies OWASP GenAI Security Project, Top 10 for Agentic Applications 2026, released December 2025. Page citations in this piece refer to that document. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ MITRE ATLAS, adversarial threat landscape for AI systems. Content release 2026.06. https://atlas.mitre.org/ Machine-readable tactic and technique IDs: https://github.com/mitre-atlas/atlas-data. Note that ATLAS split its versioning in May 2026: knowledge base content now uses a YYYY.MM scheme, and the data format is versioned separately. NIST AI RMF Playbook, suggested actions by function and subcategory. https://airc.nist.gov/airmf-resources/playbook Ken Huang, "Agentic AI Threat Modeling Framework: MAESTRO" (Multi-Agent Environment, Security, Threat, Risk, and Outcome), Cloud Security Alliance, February 6, 2025. https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threat-modeling-framework-maestro Seven-layer reference architecture: https://kenhuangus.medium.com/7-layered-agentic-ai-reference-architecture-20276f83b7ee NIST AI Risk Management Framework 1.0 (AI 100-1). https://www.nist.gov/itl/ai-risk-management-framework SAFE-MCP, the Secure Agentic Framework threat catalogue, an OpenSSF AI/ML Working Group SIG. https://github.com/SAFE-MCP/safe-mcp and https://www.secureagenticframework.org/ Article 55(1)(c)" is https://artificialintelligenceact.eu/article/55/ Foundational papers, the Rule column J. H. Saltzer and M. D. Schroeder, "The Protection of Information in Computer Systems," Proceedings of the IEEE 63(9), September 1975. https://www.cs.virginia.edu/\~evans/cs551/saltzer/ N. Hardy, "The Confused Deputy (or why capabilities might have been invented)," ACM SIGOPS Operating Systems Review 22(4), October 1988, pp. 36-38. https://dl.acm.org/doi/10.1145/54289.871709 J. P. Anderson, "Computer Security Technology Planning Study," ESD-TR-73-51, October 1972. The origin of the reference monitor requirements: always invoked, tamperproof, verifiable. J. B. Dennis and E. C. Van Horn, "Programming Semantics for Multiprogrammed Computations," Communications of the ACM 9(3), March 1966. The origin of capability-based security. Contemporary work connecting the two "Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents," June 2026. https://arxiv.org/abs/2606.26479 Cloud Security Alliance, research note on confused deputy attacks against autonomous AI agents. https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-agent-confused-deputy-prompt-injection/ Implementation nono, Apache-2.0 per-invocation capability broker for MCP-based agentic systems. https://github.com/nolabs-ai/nono and https://nono.sh