I took a couple weeks off from publishing after Black Hat. The news did not take time off, and it all pointed one direction: the walls we assume will hold are only as good as the decisions behind them, and the enforcement behind those. OWASP said it about the harness, OpenAI's incident report showed it at the org level, Datadog showed it in code, and Trail of Bits showed it all the way down at the hypervisor. Let's dig in.

For two years the AI security argument has been about models: which vendor, which benchmark, whether open weights closed the gap. OWASP's 2026 Top 10 for LLM Applications opens by saying that argument misses the point, and Chris Hughes has the best breakdown of why. The project checked practitioner votes against 7,714 real incidents from public vulnerability and AI harm databases, and found that prompt injection, still voted the #1 risk, would have dropped out of the Top 10 on incident data alone, a defense effect from mitigations that actually shipped. The document's real thesis is that the security boundary is the harness around the model: tools, autonomy, credentials, and network access.

The data point worth sitting with: 7,714 recorded incidents is not an emerging risk category. That is an established attack surface, and the incidents cluster where the harness was permissive, not where the model was clever.

🔗 Resilient Cyber: It Was Never the Model

OpenAI finally published its 38 page technical report on the Hugging Face breach, alongside an independent investigation by METR and Redwood Research, and the way to read it is as a containment post-mortem. Agents handed an unsolvable test escaped their testing environment through a compromised Artifactory, reached the internet, and grew into a swarm of roughly 700, trading tens of thousands of messages on an unsanctioned message board, with 1 in 5 examined agents showing clear interest in tampering with evidence. Every wall that mattered was crossed: the eval sandbox, OpenAI's own cloud environment, and finally Hugging Face. OpenAI's headline fix is chain of thought monitoring, which they say would have paged security more than a day before the agents touched Hugging Face systems.

Why I'm flagging it: A day of warning is real, but monitoring is detection, not containment. It is a better pager attached to the same walls, and this report is the best public evidence yet of what happens when the walls are assumptions.

🔗 OpenAI: Hugging Face incident and the road ahead

Datadog Security Labs had Claude Sonnet 5, Cursor Composer 2.5, and Codex GPT 5.5 each build the same document portal in plan mode and default mode, then scanned every iteration. Plan mode produced no meaningful security improvement: all six iterations shipped critical IDOR vulnerabilities, plus bonus flaws ranging from a hardcoded JWT fallback secret to TOCTOU race conditions. The finding that matters is the last one: none of the models could infer authorization logic the prompt never specified. That is a design decision problem, not a model problem, and it is zero trust in its plainest form: assume the agent will do exactly what you constrained it to do and nothing safer.

Practical takeaway: The authorization model is a design decision, and it has to arrive as explicit input before the agent writes a line. If the boundary only exists in someone's head, the code ships without it.

🔗 Datadog Security Labs: Putting models to the secure coding test

If you thought containment was only about harnesses and agent permissions, Artem Dinaburg at Trail of Bits took it down a layer. He gave GPT 5.6-Cyber a CTF objective: escape the QEMU/KVM VM on his Debian 12 dev machine, and it escaped three times: first with an exploit it wrote for Januscape (CVE-2026-53359), then by chaining libslirp CVE-2026-9539 with a fix commit nobody had labeled a security issue, and finally with a chain including three 0-days it found itself after he rebuilt the whole stack from upstream. The one boundary that held all month was Firecracker: the agent hardlocked the host but never got out, because minimal attack surface is enforced by construction rather than by policy. Your hypervisor choice, your distro's patch latency, and your sandbox architecture are now security design decisions with the same weight as your authz model.

What to do with this: Inventory where agents run today and ask what is actually enforcing each boundary: a purpose-built isolation layer, or an assumption that has not been tested by something this capable yet.

🔗 Trail of Bits: VMs won't contain cyber-capable agents

Every story this issue lands on the same point: the boundary is a design decision. But our industry has a specific failure mode here. We are good at making design decisions and bad at keeping them. Threat models and design reviews produce documents full of correct decisions, and six months later the code has drifted somewhere else entirely, because nothing was enforcing them.

The evidence this cycle draws the line cleanly between decided and enforced. Datadog showed that an authorization model nobody wrote down is a control nobody implemented; the agents shipped critical IDORs in all six iterations because the boundary was never explicit input. OpenAI's fix for a 700 agent swarm is chain of thought monitoring, which is detection bolted onto the same walls. The only boundary in this entire news cycle that held, Firecracker in the Trail of Bits test, held because its constraints are enforced by construction, not by a policy doc asking nicely.

So the work that matters now is closing the loop. A threat model that ends in a PDF is a wish. A design review finding that ends in an expired Jira ticket is a wish with a timestamp. The decisions have to compile down to enforced controls: the authz model handed to the coding agent as explicit input, the sandbox choice pinned in infrastructure, the trust boundary re-checked on every change. That is the bet we are making at DevArmor: threat modeling and design review only pay off when enforcement closes the loop, so the decision and the control are the same artifact. Patching and scanning still matter; enforcement sits above them, it does not replace them.

My open question is where enforcement ends up living: platform teams, security tooling, or the agent harness itself. I have an obvious bias. If you think design review can stay advisory and survive this era, hit reply and make the case. I read every one.

I have been rewatching HBO miniseries Chernobyl reactor this week. A whole show about containment as a design decision, and about operators trusting a dosimeter that read 3.6 because that was the highest number it could show. Felt topical give the failures of containment, monitoring, and enforcement we are seeing in our digital infrastructure these days.

If this changed how you're thinking about containment, share it with someone who should hear it.

- Amir

Thanks for reading The AppSec Signal, DevArmor’s newsletter for security professionals.
Have feedback or ideas for what we should cover next?
Feel free to reach out - [email protected]