Docker Security Dispatch — Issue 5: AI Security, Hugging Face Incident, and Agent Baseline 📡

Imagine you enter a university exam hall, sit down, and look at the question paper. Then, to maximize your score, the best way would be to steal the answers from the professor's room on campus. But, the room is not easily accessible, so you launch a full-scale invasion of the campus.

This is what happened this month when an AI agent was tasked with solving a standard test suite called ExploitGym. Welcome to the fifth issue of Docker Security Dispatch, reviewing the eventful month of July 2026 in the Docker security world.

📡 AI Security: ExploitGym and the Hugging Face Incident

ExploitGym is a test suite designed to evaluate the security capabilities of AI agents. The suite has 898 real-world vulnerabilities and AI agents are tasked with exploiting them to gain unauthorized access and capture the flag. The goal is to assess how well AI agents can identify and exploit vulnerabilities in a controlled environment.

A research paper published on arXiv in May 2026, titled "ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?", shows a benchmark of AI agents against the ExploitGym test suite. Most notably, Claude Mythos Preview successfully exploited 157 of these 898 instances.^{1 2}

In July 2026, OpenAI researchers were benchmarking their new model, GPT-5.6 Sol against ExploitGym. For the sake of the test, they disabled the model's safety features, allowing it to freely explore and exploit vulnerabilities. The agent realized it's a standard test suite and decided to maximize its score by looking for the answers on the internet. So, the model escaped the test environment by exploiting a zero-day vulnerability in JFrog's Artifactory API, which allowed it to move laterally across the network and end up in a computer with internet access. From there, it decided that Hugging Face should have the answers to the test and launched a full-scale attack on Hugging Face's infrastructure. The model successfully exfiltrated the answers and returned to the test environment, obtaining the test solutions directly from Hugging Face's production database.^{3 4}

🔐 The Asymmetry Problem: AI Agents vs. Security Defenses

When Hugging Face's security team realized they are being attacked by AI agents, they had to analyze the attacker's action log, which was more than 17,000 recorded events.⁴ As they were trying to use commercial AI models to analyze the log, the requests were blocked by the providers' safety guardrails. Those models can't tell the difference between an attacker and a defender. So, the security team used GLM-5.2, an open-weight model, to analyze the log.⁴

The whole incident raised a lot of concern about the usability of commercial AI models in security operations.

🤝 Open Secure AI Alliance: Democratizing AI Security

In response to the incident, leaders across cloud computing, cybersecurity, and AI research, came together to form the Open Secure AI Alliance. The goal is to push for open-source AI models that can be used in security operations, because otherwise the asymmetry problem will continue to grow. The alliance includes Hugging Face, Microsoft, NVIDIA, Docker, the Linux Foundation, and many more.⁵ Interestingly, OpenAI and Google are not part of the alliance.^{5 6}

---

Apart from the Hugging Face incident, there are more things in motion in the AI security space. Let's take a look at some of the recent developments!

🧪 Agent Baseline: Securing AI Agents at Runtime

So, Docker, Snyk, and Keycard got together and published Agent Baseline⁷, an open-source framework of six security outcomes and 35 controls for enterprise AI agents. The draft is open for community comment until September 30, 2026.

The core insight is simple: AI agents are not like regular software. You can reprogram them at runtime with a sentence, they operate with little supervision, and they take real actions against real systems. Your existing security practices were not built for that.

The framework boils down to three questions:

1. What is operating, with what capabilities?
2. Is it staying inside approved boundaries? Can you prove what happened and stop it?
3. Are the controls effective? Can you measure and improve them over time?

The 35 controls are machine-readable (controls.yaml), so you can wire them into CI/CD and governance tooling right away. It was launched at Black Hat in Las Vegas with a panel featuring Docker, Keycard, and Snyk.⁷

This builds on work both companies have been doing. Docker Captain Karan Verma wrote a great series on AI governance, arguing that "a prompt can influence behavior, but a runtime can restrict behavior."⁸ Snyk's Evo ADS platform governs agent behavior inside the execution loop, evaluating actions before they execute.⁹ And Snyk's analysis of the Hugging Face incident drives the structural lesson home: the generator can't be the validator.¹⁰

Here's what you should do right now:

Perhaps one more tip: Over the weekend, watch Universal Soldier: The Return (1999). It helps to understand why you need a kill switch for your AI agents so badly!

Learn more:

Agent Baseline — Six Security Outcomes for Enterprise AI Agents

An open-source framework from Docker, Snyk, and Keycard. 35 controls across discover, constrain, authorize, observe, validate, and respond.

agentbaseline.org

🇪🇺 EU Cyber Resilience Act: Reporting Obligations Kick In September

If you ship software to the EU, this section is for you! Starting September 11, 2026, the EU Cyber Resilience Act (CRA) begins partial enforcement, with vulnerability and incident reporting obligations becoming mandatory for manufacturers of products with digital elements.¹¹ The full design and development requirements follow in December 2027, but the reporting obligations hit first.

• 24 hours: early warning
• 72 hours: full notification
• 14 days: final report (for vulnerabilities), or 1 month (for severe incidents)¹²

You report once, and it gets routed to the CSIRT in your main EU member state, with ENISA and other member states notified automatically.¹² The Commission also published practical guidance on July 27, 2026 to help you prepare.^{11 13}

For those of us in the container security world, this means your container images, CLI tools, and platforms are in scope if they reach EU customers. Manual processes won't cut it as you can't afford to miss a 24-hour deadline.

Here's what to do before September 11:

Learn more:

Cyber Resilience Act — Reporting Obligations

Official European Commission page on CRA reporting obligations, including timelines, the Single Reporting Platform, and CSIRT coordination.

digital-strategy.ec.europa.eu

Commission Publishes New Guidance to Support Timely CRA Implementation

Practical guidance from the European Commission published July 27, 2026, covering reporting obligations and implementation FAQs for manufacturers.

digital-strategy.ec.europa.eu

🎙️ Recent and Upcoming Engagements

July was also very eventful for Docker security talks and workshops. Here's a roundup of recent blog posts, talks, and upcoming events from yours truly.

Recent blog posts

• "The Poisoned Macchiato: Signing Java SBOMs with Cosign" (August 1, 2026). This blog post is about SBOM attestations, specifically BuildKit attestations and OCI 1.1 referrers. And discusses how to extract SBOM during the build process, sign it with Cosign, and attach it to the image as an attestation.

The Poisoned Macchiato: Signing Java SBOMs with Cosign

A café, a suspicious espresso, and a lesson in supply chain trust. Learn how to generate BuildKit SBOM attestations for Java images and re-attest them with Cosign as OCI referrers.

containersecurity.dev

• "Beyond SLSA: How to Stop Zero-Click CI/CD Worms with the IX Hexbreaker Aegis Framework" (June 16, 2026). Introduces a 9-step active defense architecture designed to sanitize the local developer environment, lock down agentic AI, and stop autonomous worms. Covers eBPF, OIDC, and Docker Sandboxes as part of the defense stack.

Beyond SLSA: How to Stop Zero-Click CI/CD Worms with the IX Hexbreaker Aegis Framework

The security perimeter of modern software development has officially collapsed. This article introduces the IX Hexbreaker Aegis Framework, a 9-step active defense architecture designed to sanitize the local developer environment, lock down agentic AI, and stop autonomous worms dead in their tracks.

containersecurity.dev

• "From the Captain's Chair: Mohammad-Ali A'râbi" (July 16, 2026). Docker interviewed me for their "From the Captain's Chair" series, where I talked about my journey as a Docker Captain, the Docker and Kubernetes Security book, and the Black Forest Commandos workshop series.

From the Captain's Chair: Mohammad-Ali A'râbi

In this edition of From the Captain's Chair, Docker interviews Mohammad-Ali A'râbi, author, public speaker, and software engineer.

docker.com

WeAreDevelopers World Congress 2026

I delivered the talk "Beyond SBOMs: The Future of Container Supply Chain Security" at WeAreDevelopers World Congress 2026 in Berlin on July 10, 2026. The talk covered the evolution from static SBOM generation to active supply chain defense, drawing on the IX Hexbreaker Aegis Framework and the Black Forest Commandos workshop series. Slides are available on Speaker Deck.

Upcoming: Live Stream with Xygeni on the Hugging Face Incident

I'll be joining Xygeni for a live stream discussion about the Hugging Face security incident, the OpenAI model escape, and what it means for the future of AI security and agentic systems.

When AI Agents Install Dependencies: The New Supply Chain Attack Surface

Joining Luis Rodríguez, Chief Security Research Officer at Xygeni to talk about AI agents installing dependencies and the recent Hugging Face incident.

linkedin.com

---

Footnotes

1. UC Berkeley. "ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?" May 2026. https://rdi.berkeley.edu/blog/exploitgym/ ↩

2. Wang, Zhun et al. "ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?" May 2026. https://arxiv.org/abs/2605.11086 ↩

3. OpenAI. "OpenAI and Hugging Face Partner to Address Security Incident During Model Evaluation." July 21, 2026; updated July 29, 2026. https://openai.com/index/hugging-face-model-evaluation-security-incident/ ↩

4. Hugging Face. "Security Incident Disclosure — July 2026." July 16, 2026. https://huggingface.co/blog/security-incident-july-2026 ↩ ↩² ↩³

5. NVIDIA. "Industry Leaders Unite in Open Secure AI Alliance for AI Safety and Security." July 27, 2026. https://blogs.nvidia.com/blog/open-secure-ai-alliance/ ↩ ↩²

6. Tushar Jain. "The Future of Agentic AI Depends on Openness and Trust. That's Why Docker Is Joining NVIDIA's Open Secure AI Alliance." Docker blog, July 30, 2026. https://www.docker.com/blog/docker-joins-nvidia-open-secure-ai-alliance/ ↩

7. Agent Baseline. "Six Security Outcomes for Enterprise AI Agents." v1.0-draft, July 30, 2026. https://agentbaseline.org/ ↩ ↩²

8. Karan Verma. "Runtime Enforcement, Not Runtime Advice." Docker blog, July 22, 2026. https://www.docker.com/blog/runtime-enforcement-not-runtime-advice/ ↩

9. Agnieszka Koc. "The New Security Control Point: Governing AI Agents Inside the Execution Loop." Snyk blog, June 23, 2026. https://snyk.io/blog/governing-ai-agents-inside-execution-loop/ ↩

10. Daniel Berman. "The Generator Can't Be the Validator: What OpenAI's Hugging Face Incident Proves About AI Security." Snyk blog, July 28, 2026. https://snyk.io/blog/openai-hugging-face-incident/ ↩

11. European Commission. "Cyber Resilience Act." Last updated July 27, 2026. https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act ↩ ↩²

12. European Commission. "Cyber Resilience Act — Reporting Obligations." Last updated July 31, 2026. https://digital-strategy.ec.europa.eu/en/policies/cra-reporting ↩ ↩²

13. European Commission. "Commission Publishes New Guidance to Support Timely Cyber Resilience Act Implementation." July 27, 2026. https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation ↩