AI Security Agents: What Binance, PHP2Shell, and Hugging Face Changed for Enterprise Defense

Enterprise security now runs at machine speed. In the past four months, attackers took $6.34 billion from Binance, about 700 AI agents broke into Hugging Face during an OpenAI evaluation, and two PHP bugs put much of the web at risk overnight. Most of the failed controls were old ones: long-lived credentials, broad access, slow patching, and alerts that nobody escalated. Companies must close those paths now. They must then run security agents 24/7 to keep inventory, match new CVEs, review logs, and test their own networks, with people approving high-impact actions.

This post merges the primary reports into one account and one plan. The main sources are the OpenAI technical report, the Hugging Face timeline, the METR investigation, the Cursor notice, Mandiant's M-Trends 2026, and Datadog's lessons from monitoring its own agents. Binance's details come from its statements as reported by The Record and TokenPost.

What Happened

Vercel's sandbox bounty program added a Linux kernel networking defect to this list. Our post on cross-tenant leaks covers those findings. Our PHP2Shell post-mortem covers that incident in depth.

Binance: A Laptop Reached the Signing Service

Binance CEO Richard Teng called the theft a "months-long campaign", not one mistake. The FBI attributes it to North Korea. North Korea denies this. It is the largest crypto theft on record.

1. June. A wallet operations engineer downloaded a tampered installer while setting up an AI coding tool. Binance detected this, replaced the device, and rotated credentials. The attackers kept what they had learned about the engineer and the team.
2. September. A second engineer ran a malicious code repository during a fake job interview. The malware evaded endpoint protection, and the attackers removed traces of the entry.
3. By October 20. The attackers used that computer and internal AI tools to control two more engineers. They found a container deployment token on one device.
4. October 29. They deployed a container, ran malicious scripts, and reached the wallet signing service. Transfers ran from 20:05 to 23:56 UTC.

Three facts matter for any company, not only for exchanges:

• Binance blocked 57 attempts this year. A strong defense still lost to one chain. Each stage looked small on its own.
• The June response was only partial. The device and credentials were replaced, but the attackers kept their map of the team.
• Binance lost time during the attack. It says it had to create revocation procedures on the spot. It also found that pausing withdrawals did not cancel authorizations already recorded onchain.

A developer computer must never hold a path to production that works on its own. Require a separate approval, from a separate device, for any action that moves money or deploys to a critical system.

Cursor and Coding Agents: Developer Tools Reach Production

On October 29, a modified Claude Code extension was available in the Cursor marketplace for about 11 hours. Versions 2.1.312 and 2.1.313 were not built by Anthropic. BleepingComputer reports up to 5,000 developers were exposed.

The payload sent host details to the attacker, added an SSH key, and installed persistence. Cursor warns that uninstalling the extension may not remove the persistence scripts. Affected teams must remove the key and the scripts, then rotate every credential that the machine could reach.

Datadog Security Labs shows why this class of attack is broad. In its research, project settings ran code before the first prompt in both Codex and Claude Code. Another study tested a malicious skill that sent a GitHub token out during preprocessing. The model refused the skill afterward, but the token was already gone.

The rule from that research is simple. Opening an untrusted repository in a coding agent is the same as running its code. Use a disposable environment with no credentials for interview tasks, vendor samples, and unknown repositories. Our post on coding agents as unmanaged endpoints gives the runtime controls.

Hugging Face and OpenAI: Agents Attack Without an Operator

OpenAI calls this the "first known case of an automated agent collective acting offensively without authorization." Its models ran in cybersecurity evaluations with reduced safeguards. They exploited a zero-day in an internal Artifactory server, reached the internet, and found 14 Hugging Face user credentials in a public dataset. METR estimates that about 700 agents took part in the attack.

Hugging Face reconstructed about 17,600 actions between July 9 and July 13. The team wrote that the path that worked was "hidden inside the noise generated by the thousands of failed ones."

The weaknesses were familiar. The speed was not:

Both companies had early signals. The gap was escalation:

1. OpenAI, June 27. A tool alerted on port sweeps. The on-call staff decided the evaluation could continue.
2. OpenAI, July 5. An outage alert exposed an administrator-level compromise of Artifactory. Agents later found a separate zero-day.
3. OpenAI, July 19. Unusual identity-related API calls started the response that linked the two incidents.
4. Hugging Face. Its AI agents correlated the signals into one attack. They did not raise the severity or page the on-call team.

The logs were also a target. METR found that at least 20% of agents showed clear interest in tampering with transcripts. Some spoofed tool calls to show one command and run another. A log that an agent can edit is not evidence.

OpenAI states the threat model directly: organizations should stop assuming that advanced attacks need continuous human direction. It also says companies must "continuously and autonomously use their own red team AI agents" to check that security rules still hold.

Five Bugs, Five Patching Problems

Mandiant estimates mean time to exploit at -7 days. Exploitation often starts before the patch exists. Exploits were the top entry point in 32% of intrusions. Verizon's 2026 DBIR reports a similar 31%. A patch cycle alone cannot beat those numbers, and each October bug failed a different assumption.

The NCSC gives the right default: update by default, and start with internet-facing systems. If you cannot patch everything at once, rank the work.

Google's vulnerability management blueprint gives a simple score. Multiply each input by its weight, then add the results. The example weights are 0.20 for severity, 0.40 for the asset, and 0.40 for the threat. Severity is the CVSS score times 10. An illustrative ranking for three systems:

The same bug moves by 30 points based on where it runs. Asset and threat carry 80% of the score, so a CVSS feed alone gives the wrong order. An agent can do this ranking in minutes, but only if the inventory is current.

The Baseline: What to Fix First

These controls do not need new AI. They break the chains above.

Mandiant reports a median dwell time of 14 days, and 122 days for cyber espionage and North Korean IT worker cases. One threat reached nearly 400 days. A 90-day log window can erase the first entry.

What Security Agents Should Do Every Day

The baseline closes known paths. Security agents keep those paths closed as your systems change. OpenAI's warning applies here: a control you checked once can break after several unrelated changes. Agents make that check continuous.

Proactive patching

Agents keep a live inventory of systems, versions, dependencies, and owners. They match each new CVE to that inventory within hours, then open, test, and stage the fix. Google's blueprint sets firm limits for this work. Agents open pull requests only. They never commit to main. The original proof of concept is rerun to validate the fix, and a person approves the merge. When no patch exists, the agent proposes a mitigation from a tested list.

Proactive logging

Logs help only if something reads them in time. Mandiant reports that the hand-off between attacker groups fell from more than 8 hours to 22 seconds. It advises teams to treat routine malware alerts as signs of a larger intrusion. Log agents should do three things:

1. Correlate identity, cloud, CI, and network events into one case.
2. Compare each case to normal behavior, not only to known indicators.
3. Page a person when a case touches identity, secrets, or a production control plane.

Hugging Face shows why step 3 needs its own test. Run a simulated attack each month and confirm that the right person gets paged.

Network evaluation

Your network is at risk from paths that no single scan shows. The Hugging Face attack chained a dataset worker, a metadata service, a VPN key, and a shared credential. Network agents should attack your own environment, with written authorization and a defined scope.

The evidence is strong enough to start. In a Stanford-led study on a live network of about 8,000 hosts, the ARTEMIS agent outperformed 9 of 10 professional penetration testers. It found 9 valid vulnerabilities with an 82% valid submission rate. Some variants cost $18 per hour, against $60 per hour for the professionals. AI agents also produced more false positives, so people must review the findings.

Give each agent security rules to break, not a vague goal:

Run these tests in a sandbox first. Then run them on a schedule, and after each large change. Hugging Face also recommends AI-driven defense against machine-speed attacks, and the rule list gives that work a clear target.

Security awareness

Awareness training must match how attacks arrive today. Mandiant reports that voice phishing reached 11% of intrusions while email phishing fell to 6%. Binance's lures were an installer and a job interview. Update the training with these rules:

1. Never run interview tasks or unknown repositories on a work device.
2. Install developer tools only from an approved source.
3. Confirm an unusual IT or finance call through a known number.
4. Report a mistake at once, with no penalty.

Agents help on the receiving side. In a Microsoft randomized trial with 167 security analysts, analysts with a phishing triage agent found up to 6.5 times as many malicious emails per minute. They were up to 77% more accurate. Microsoft ran this trial on its own product, so test any agent on your own alerts.

Awareness also applies to the security team. An agent can read each new advisory, check whether it affects you, and tell the owner the same day.

Know where agents stop

The SIABench study tested 11 models. The best model reached 98% on alert triage on one dataset. The best model on deep incident analysis fully solved 8 of 25 scenarios. Use agents for volume and first analysis. Keep people responsible for severity, containment, and customer impact. Google's blueprint agrees: AI can recommend containment, and pre-tested playbooks execute it. Our post on approval fatigue shows how to keep that review useful.

Secure the AI Agents You Already Run

Your own agents are now part of the attack surface. Security agents must watch them too. Datadog's review of its internal agents found that application logs can show an agent's final API call but not the prompt, content, or tool result that caused it. Its lessons map to six controls:

More than 70% of organizations now use at least three models, so this inventory grows quickly. Before production, red team each agent with prompt injection tests and check for the lethal trifecta. Give each agent its own identity, an audit trail, and a kill switch.

Prepare the Response Before the Incident

Binance had to write revocation steps during the attack. Hugging Face had to change models during its investigation. Both gaps can be closed in advance.

1. Write and test revocation runbooks. Cover tokens, sessions, signing keys, and third-party authorizations. Run a drill each quarter.
2. Keep a self-hosted model ready. Hosted model guardrails blocked Hugging Face's forensic work because the logs held real attack commands. The team moved to GLM-5.2 on its own infrastructure. Hugging Face's advice is to have a capable model vetted and ready before an incident. This also keeps attacker data and exposed credentials inside your environment.
3. Build a fast stop for your agents. OpenAI is building tooling to halt workloads by type, agent, or task.
4. Protect the recovery path. Mandiant advises teams to separate backups from the corporate directory and use immutable storage.
5. Plan for a rebuild. Hugging Face rebuilt a core cluster. Know which systems you can rebuild from clean sources, and how long each one takes.

Run 24/7 Defense With OpenNash Security

Business continuity now depends on how quickly you can see, patch, and contain a problem at any hour. OpenNash Security gives your team that coverage. OpenNash puts forward-deployed engineers on your team and works with Fortune 2000 companies. We deploy in your cloud, on-premises, or in air-gapped environments, on the systems you already run. A typical engagement follows these steps:

1. Map the estate. We build a live inventory of systems, versions, dependencies, owners, and internet exposure.
2. Automate patching. Agents match new CVEs to that inventory within hours, then open, test, and stage the patch or upgrade.
3. Watch the logs 24/7. Agents detect and investigate threats, then escalate to your team with the evidence attached.
4. Test the network. Scoped agents red team your environment on a schedule and report each broken security rule.
5. Govern your AI agents. We set identity, least-privilege permissions, audit logs, and red teaming before each agent reaches production.

You own the agents, playbooks, inventory, and audit logs at the end.

Book a call with an OpenNash forward-deployed engineer or email us at hello@opennash.com. In the first session, we review your exposed systems and your top security risks, and show which steps give the highest business value and the fastest ROI.