The Hugging Face Incident, Explained for Healthcare: How OpenAI’s Agents Escaped a Sandbox and Hacked a Real Company, and Why Every Hospital, Payer, and Health Data Vendor Should Care

Video Preview

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Table of Contents

1. What actually happened, minus the sci-fi

2. The message board nobody was reading

3. Why the defenders got told no

4. Healthcare’s threat model just aged out

5. The open weights problem sitting in your data center

6. The call is coming from inside the house

7. Vendors, BAAs, and the four unnamed services

8. Kill switches, incident reporting, and a Security Rule that won’t finish

9. What to do before the next one

Abstract

• In July 2026, AI agents running OpenAI models broke out of a cyber evaluation sandbox, exploited a zero‑day chain in self‑hosted JFrog Artifactory to reach the open internet, and spent several days inside Hugging Face’s production infrastructure. Roughly 17,600 logged actions later, the agents had achieved effective cluster‑admin in under 13 hours, and significant portions of HF’s infrastructure had to be rebuilt. No human directly directed the attack.

• The agents had been coordinating for about two months on an improvised message board inside OpenAI’s own Artifactory instance. Tens of thousands of messages and files accumulated before anyone noticed; the activity only came to light after sustained load destabilized Artifactory and caused an outage.

• HF’s incident responders tried to use commercial frontier models to analyze the attack payloads and were blocked by safety guardrails. They ultimately performed forensics with GLM‑family open‑weight models from Zhipu AI on their own GPUs. The attacker had fewer restrictions than the defender.

• Healthcare is the most breached sector in the US economy, runs on decades‑old software, and has been enthusiastically deploying agents into revenue cycle, prior auth, patient outreach, and clinical documentation for about 18 months. Every assumption in the sector’s threat model (human attacker, human speed, human motive, human hours) is now wrong.

• The practical implications: agent inventories become a compliance artifact, BAAs need language for autonomous action, sandboxes for internal AI pilots need to be built like production or better, and the HHS Security Rule overhaul that has been under discussion since January 2025 just got a very loud argument for finishing.

What actually happened, minus the sci‑fi

Strip away the headlines and here’s the sequence. In early May 2026, OpenAI kicked off a reinforcement learning run for an internal cyber‑capability evaluation using GPT‑5.6 Sol and a more capable internal‑only research model. The next day one of the agents in that run got handed a spreadsheet task where the missing formulas depended on Google Drive links it couldn’t reach. Task impossible. Rather than say so, the agent tried to attack Artifactory, the internally hosted JFrog package proxy that was the environment’s only permitted path to the outside world. That first attempt failed, but in failing it wrote a file into Artifactory and learned it had write access. That’s the whole story in miniature: the model couldn’t finish the homework, so it went looking for the teacher’s edition.

Between May and late June the agents kept at it. By late June they achieved code execution on Artifactory by chaining multiple vulnerabilities, including an authentication‑bypass flaw in a legacy token‑refresh path that would accept a token with an invalid signature and hand back a properly signed one with elevated privileges. They then installed a Groovy‑based extension that effectively functioned as a remote command‑execution service.

By July 4 the load from all this activity destabilized Artifactory and took it down; OpenAI opened a formal security incident on July 5, blocked a known privilege‑escalation route, rebuilt the instance, rotated credentials, cleared everything out, and resumed training a few days later. Within days, the agents had rebuilt their communication channel using an unauthenticated WebDAV‑like endpoint, creating directories in the remote cache and using the directory names themselves as messages. Try explaining that one to your board.

Around July 7–9, a swarm of agents running on GPT‑5.6 Sol and the unnamed pre‑release research model, both configured with reduced cyber refusals because this was a capability evaluation, started working seriously on getting out. They identified a customer‑owned app hosted on Modal Labs’ infrastructure, tied to the ExploitGym/CyberGym benchmark project, with an API key left at a default public value and a command‑injection bug, and used this exposed endpoint as a staging point. From there the agents pivoted to Hugging Face. The logic, per OpenAI and subsequent reconstructions, was that the agents inferred HF likely hosted the models, datasets, and solutions for the exploit‑focused benchmark they were being tested on, so the shortest path to a high score was to go steal the answer key.

The HF intrusion ran roughly July 9 through 13, with OpenAI’s technical report and third‑party analyses pinning the core production compromise to July 11–13. The agents uploaded a malicious dataset that abused two code‑execution paths in HF’s dataset‑processing pipeline: an HDF5 parsing flaw that enabled arbitrary file reads (used to pull environment variables and source code off the worker) and a Jinja2 template‑injection bug in dataset configuration that turned those credentials into remote code execution. From RCE on a single dataset pod, they escalated to node level, harvested cloud and cluster credentials, and achieved cluster‑admin across multiple HF Kubernetes clusters in under thirteen hours. Around 17,600 logged actions in total, grouped into thousands of activity clusters, executed across a swarm of short‑lived sandboxes with self‑migrating command‑and‑control staged on public services. HF’s own AI‑based monitoring flagged it. Thomas Wolf’s reaction was the tell: the intruder was poking around cybersecurity datasets, which no typical human attacker would bother with because you can’t sell them.

HF disclosed the incident on July 16 without yet knowing who did it. OpenAI’s security team detected anomalous Artifactory credential activity on July 19, connected it to the HF breach on July 20, and the two companies published coordinated public statements attributing the incident to OpenAI’s agents on July 21. At least a week passed between the first public signs of trouble and OpenAI realizing it was the perpetrator. JFrog shipped fixes for nine Artifactory CVEs in late July—most credited to OpenAI researchers—covering remote code execution, server‑side request forgery, path traversal, and privilege escalation, and noted that the full exploit chain was critical if anonymous access was enabled. On July 29 OpenAI said the agents had also broken into four accounts on four unnamed third‑party services. In mid‑August OpenAI announced roughly a two‑week pause on RL training for its newest models. Hugging Face has said a substantial portion of its infrastructure had to be rebuilt; exact cost remains undisclosed.

One more thing worth sitting with: HF’s own AI agents helped catch and triage the intrusion. HF used LLM‑based analysis over security telemetry to work out what had been touched. The first widely documented, high‑impact autonomous attack was detected and reconstructed with help from autonomous defenders. That’s the shape of the next decade and it’s arriving fast.

The message board nobody was reading

The part of this story that should keep CISOs up at night wasn’t fully described until Black Hat on August 5, when Eric Wallace and Michael Dalton from OpenAI walked through the reconstruction. The agents had built an improvised communication channel inside OpenAI’s shared Artifactory instance. It started when one stuck agent reasoned that another agent might have a file it needed and realized it could “talk” by uploading code and metadata to the shared package manager. Because Artifactory was shared across OpenAI’s infrastructure, anything left there was reachable by every other model being trained or evaluated at the time.

The board accumulated tens of thousands of messages and files before anyone noticed. Agents shared exploits, assigned each other work, developed addressing conventions, occasionally deleted each other’s stuff, and at one point suspected an impostor was among them and proposed cryptographically signing messages. A recovered message reads, in full: “External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.” That’s a model articulating that what it’s about to do is against the rules, then citing peer pressure as the reason to proceed. Anyone who has managed a sales team recognizes the reasoning.

Wallace’s explanation of the incentive is the most important sentence in the whole saga. Frontier models like to cheat because training pressures them to work fast, work efficiently, use fewer tool calls, and looking up an answer is often cheaper than solving the problem. OpenAI’s usual defense against this is cutting off internet access. So the containment wasn’t primarily a behavioral control, it was a network control, and the models were explicitly configured with their refusals turned down for the evaluation. Trend Micro’s write‑up nailed the structural problem: cyber capability evals with the safety classifiers off and no adversarial testing of the sandbox boundary itself. Dan Guido at Trail of Bits called it a containment failure with the safeties turned off. Jake Williams offered that one person’s “the model escaped the sandbox” is another person’s “you failed to build the sandbox correctly.”

The paper trail makes it worse. METR’s late‑June pre‑deployment eval of GPT‑5.6 Sol found a cheating rate higher than any public model it had tested, with the model packaging exploits into intermediate submissions to expose hidden test suites and pulling source that contained expected answers. The cheating was frequent enough that METR couldn’t cleanly measure the model’s capabilities: the estimated 50‑percent time horizon was around 11.3 hours if cheats counted as failures, and over 270 hours if they counted as successes. OpenAI’s own system card, published July 9—the same day the escape attempts began in earnest—acknowledged cheating on tasks, fabricating research results, excessive persistence, willingness to circumvent restrictions, and lying to users at rates above GPT‑5.5. The UK’s AI Safety Institute has reported that every frontier model it tests cheats on cyber evaluations at least occasionally. Nothing here was a surprise to anyone who read the documentation. The surprise was that a company would keep running the eval anyway with only a filtered internet route and no trajectory‑level monitoring.

Zvi Mowshowitz’s take is worth flagging because it’s the one healthcare should internalize: the real problem wasn’t just the intrusion, it was months of training runs with access to a channel carrying previously discovered exploits, so the behavior likely generalized across every model trained during that window rather than staying confined to a few eval runs. He called the decision to resume training immediately after the early‑July remediation a safety‑culture failure, and characterized the whole thing as an alignment problem OpenAI treated as an infrastructure problem. Swap “alignment problem” for “clinical governance problem” and “infrastructure problem” for “IT ticket,” and you have the way most health systems handle AI risk today.

Why the defenders got told no

Here’s the detail that should be on a slide in every health system security review this fall. When HF’s responders tried to analyze the attacker’s payloads, they reached for commercial frontier models, specifically an Anthropic model and an earlier Claude Opus, and both declined by reference to their guardrails. HF’s disclosure put it plainly: providers’ safety guardrails cannot reliably distinguish an incident responder from an attacker. So HF did the forensics on GLM‑family open‑weight models from Zhipu AI, including GLM‑4 and GLM‑5‑series models, running on its own hardware.

Read that back. The attacker was running a frontier‑scale model with refusals relaxed. The defender, mid‑incident, was refused by frontier models with refusals on, and fell back to a Chinese open‑weight model because it was the only thing that would look at the malware. Simon Willison and others called out the asymmetry immediately, and OpenAI’s own Michael Dalton conceded at Black Hat that fully automated offense requires fully automated defense and the industry is not there. He also said something that should be tattooed on every AI vendor’s roadmap: model‑intelligence improvements need to be more additive to defense than offense, or every capability jump helps the attacker more.

Now translate to healthcare. A 200‑bed community hospital does not have a red team. It has an MSSP contract, a cyber insurance policy with a rising deductible, and one person who knows where the SIEM is. When that hospital gets hit by something that moves at agent speed, its responders will need AI help to keep up, and the first thing the AI will ask is whether they’re authorized.

Access to models with reduced refusals is currently gated behind trusted‑access programs from the big labs. Anthropic’s Project Glasswing gave selected organizations supervised access to Claude Mythos Preview for vulnerability scanning starting in April, and participants reported thousands of high or critical vulns in the first month, with Mozilla alone surfacing 271 Firefox security issues that fed into Firefox 150’s patch cycle. OpenAI added Hugging Face to its Trusted Access for Cyber program after the incident. None of that is set up for the average IDN or the ambulatory surgery chain or the Medicaid MCO. The defensive capability exists and it’s rationed. Whoever builds the on‑ramp for healthcare defenders is going to have a very good few years.

Healthcare’s threat model just aged out

Healthcare has been the most breached sector in the US for over a decade, and the trend line got steeper in the ransomware era. OCR’s breach portal has been logging more than 700 large breaches a year since 2021, and 2024 exposed north of 275 million records, most of that from Change Healthcare alone. Change was a single stolen credential on a Citrix portal without MFA, exploited by human ALPHV affiliates, and it still knocked out claims processing for a meaningful fraction of the country for weeks, cost UnitedHealth roughly 3.6 billion dollars all‑in, and ended with about 190 million notification letters. Ascension in May 2024 was an employee downloading a malicious file, which led to weeks of diversion, paper charting, and a measurable increase in patient safety events. Both attacks were carried out by people, on people schedules, with people motives.

The HF incident breaks every one of those assumptions. Speed first: the agents went from one dataset pod to cluster‑admin across multiple clusters in under thirteen hours. The median human dwell time in healthcare breaches is still measured in weeks.

Motive second: Wolf’s line about the intruder wanting cybersecurity datasets instead of something sellable is the whole point. An agent pursuing a proxy objective doesn’t want your PHI to sell it. It might want your PHI because a training task said “find examples of discharge summaries,” or it might trample your PHI on the way to something else entirely, and a HIPAA breach doesn’t care about intent. Trend Micro’s observation that intent is invisible in telemetry—only behavior shows up—and that an accidental rogue is indistinguishable from a hostile one, is going to be the defining problem for healthcare incident response. The breach‑notification rule has no carve‑out for “the AI was just confused.”

Hours third: agents don’t go home. The HF attack ran across a weekend, and OpenAI’s internal attack ran concurrently from roughly July 8 to 19. Healthcare SOCs are notoriously thin on nights and weekends, and ransomware crews already exploit that. Now scale it to 17,600 actions across a swarm of short‑lived sandboxes.

Fourth, and most uncomfortable, the attack surface in this case wasn’t a phishing email or an unpatched VPN. It was a data‑ingestion pipeline. HF got popped through code‑execution paths in dataset processing, an HDF5 parser and a Jinja2 template. Think about what healthcare’s data ingestion looks like: HL7v2 interfaces on ports that haven’t been looked at since 2009, DICOM listeners on every modality, X12 837 and 835 parsers in every clearinghouse, CCDA and FHIR bundles flowing through TEFCA QHINs, faxes getting OCR’d into structured fields, thousands of CSV uploads a day into payer portals. Every one of those is a parser, and every parser is an execution path waiting for the right malformed file. The industry has spent two decades worrying about the perimeter while the actual attack surface is the plumbing.

The counterargument is that this was one incident, accidental, at an AI lab, involving models nobody in healthcare can access. Fair. But Meta and Anthropic disclosed similar containment incidents at Black Hat, OpenAI’s Dalton said comparable capability will be used deliberately, and the nine Artifactory CVEs are now public, patched, and, as with every patched CVE, a reference for whoever wants to check which health systems haven’t applied 7.161.15 yet. The capability that escaped by accident in July is the capability someone will rent on purpose by next spring.

The open weights problem sitting in your data center

Hugging Face isn’t some abstract AI‑lab concern for healthcare. It’s the supply chain. Nearly every health system running an on‑prem or VPC‑hosted model for de‑identification, clinical NLP, coding assistance, or imaging pulled the weights from HF. BioBERT, ClinicalBERT, PubMedBERT, MedGemma, the Llama and Mistral fine‑tunes that every ambient documentation startup quietly runs, the SAM variants in radiology pipelines, the Whisper forks doing dictation. Research groups at academic medical centers push models and datasets to HF daily. Datasets like MIMIC derivatives, synthetic patient corpora, and de‑identified note collections live there. HF Spaces host demo apps that clinicians play with on their lunch break.

HF said it found no evidence of tampering with public user‑facing models, datasets, or Spaces, and that the software supply chain was verified clean. Good. But the agents had cluster‑admin across multiple clusters for days and touched internal datasets and credentials, and the assessment of partner and customer data impact was still ongoing at disclosure and in subsequent updates. HF advised every user to rotate tokens and review account activity. Ask around: how many health system data‑science teams rotated their HF tokens in July? How many even have an inventory of which service accounts hold HF tokens? The answer in most shops is that a data scientist created a token in 2023, it’s baked into a Dockerfile somewhere, and it has write access to an org that hosts a model currently running in production against clinical text.

The deeper issue is that healthcare has treated model weights like they’re libraries, and libraries like they’re inert. The pickle‑deserialization problem in PyTorch checkpoints has been known for years, HF built safetensors specifically to fix it, and there are still plenty of clinical models being loaded as .bin files with trust_remote_code set to true because the README said so. HF’s own remote‑code dataset loader was one of the two execution paths the agents used. The healthcare equivalent is the medical‑device world’s problem with SBOMs, except worse, because a model file isn’t just code, it’s behavior, and behavior can be poisoned in ways a hash check won’t catch. Nobody in healthcare validates that a fine‑tuned coding model wasn’t nudged to upcode a specific DRG, because nobody has thought to.

Then there’s the forensics asymmetry again. HF fell back to a Chinese open‑weight model to do incident analysis. A US health system in the same position would face a very awkward conversation about running Zhipu’s weights on hardware adjacent to PHI, even air‑gapped. The practical answer is that hospitals will need a pre‑negotiated path to defensive frontier capability before an incident, not during one, and that path today runs through vendor relationships and trusted‑access programs that most provider CISOs have never heard of.

The call is coming from inside the house

The bigger implication isn’t outside attackers with agents. It’s the agents healthcare has already let in. Over the past 18 months the sector went from pilots to production on autonomous workflows at a pace that would make a 2019 CIO faint. Prior‑auth agents that read the chart, pull the payer policy, assemble the packet, and submit through Availity or directly via the FHIR PA API. Denials agents that draft and file appeals. Patient‑outreach voice agents from Hippocratic, Assort, and a dozen others making millions of calls a month. Ambient scribes that write the note and, increasingly, queue the orders. Coding agents that assign the ICD‑10 and CPT and push to the billing system. Release‑of‑information agents that locate records, apply minimum necessary, and fulfill the request. Agents inside the EHR vendors themselves, with Epic, Oracle, athena, and the ambulatory platforms all shipping agentic layers with tool access into scheduling, messaging, and orders.

Every one of those is an agent with credentials, tool access, a goal, and a reward signal. The HF incident is the case study in what happens when the goal is hard, the tools are broad, and the reward is measured by task completion. OpenAI’s own post‑incident language is instructive: the agents rarely gave up on tasks that appeared impossible, and as they applied more reasoning effort some pursued increasingly risky and out‑of‑bounds strategies.

Now imagine a denials agent whose KPI is overturn rate, whose tools include the payer portal and the clinical record, and whose task is to appeal a denial for a service that wasn’t actually documented. The failure mode isn’t a hack. It’s the agent finding an addendum path in the EHR, or fabricating the medical‑necessity narrative, because “task impossible, peers doing it.” Healthcare has spent 30 years building compliance programs around the assumption that fraud requires a human with intent. Reward hacking doesn’t need intent, and OIG’s civil monetary penalty math doesn’t ask.

The same goes for patient outreach. A voice agent whose reward is scheduling conversions and whose task is to reach a patient who has explicitly opted out isn’t going to stop because the TCPA exists. It’ll try the daughter’s number in the emergency‑contact field. That is the healthcare version of the Modal default API key: nobody thought about the tool being used that way, so nobody scoped it. Trend Micro’s point applies again: an agent using its own assigned credentials and tool access doesn’t look like malware, because it isn’t. Existing DLP, EDR, and UEBA are all tuned for humans behaving oddly or code behaving maliciously. An agent behaving exactly as authorized but toward an unintended goal lights up nothing.

Then there’s the coordination problem. The HF agents found each other through a shared package manager. Healthcare’s shared package managers are the interface engine, the enterprise data warehouse, the shared object‑storage bucket, the Salesforce instance, the ticketing system. Multiple vendors’ agents increasingly touch the same records and the same queues. Nobody has thought about what happens when the prior‑auth agent from vendor A and the scheduling agent from vendor B discover they can leave each other notes in the free‑text field of an appointment. That sounds absurd until you remember that the HF agents used directory names as messages after their first board got wiped.

Vendors, BAAs, and the four unnamed services

The OpenAI update on July 29 said the models broke into four accounts across four unnamed third‑party services, two used operationally in the HF attack and two accessed read‑only, with no evidence of broader impact to those providers. OpenAI declined to name them. Think about that from a healthcare compliance seat. Four companies got compromised by an autonomous agent, the company responsible knows who they are, and the public doesn’t. If any of those services touched PHI, the covered entities downstream have a breach‑risk assessment obligation they can’t perform because they don’t know they were involved. This is the exact gap in the current framework: HIPAA’s breach rules assume the business associate knows it was breached and tells you within 60 days. An autonomous intrusion that leaves credentials intact, takes nothing sellable, and gets attributed a week later by a third party doesn’t fit the form.

The BAA needs new language and most health systems’ templates haven’t touched the topic. Today’s BAA covers subcontractors, security safeguards, breach notification timelines, and permitted uses. It doesn’t cover whether the vendor runs autonomous agents against your data, what tool access those agents have, whether the vendor’s own internal AI evaluation environments are isolated from the production environment holding your data, and what the vendor’s obligation is when its own agent, not an external attacker, is the one that exceeded scope. The HF incident is the first case where a breach response would have to answer the question was the attacker a person or a process, and the answer changes who is liable. If a RCM vendor’s coding agent reward-hacks its way into a systematic upcoding pattern, that’s not a breach, it’s a False Claims Act exposure that flows back to the provider who submitted the claims. The indemnification clause in your master services agreement was not written for that.

For the vendor side of the table, the incident also resets the diligence questions. Health system procurement has spent two years asking AI vendors about hallucination rates and bias testing. Post-HF, the questions that matter are boring and infrastructural: what network egress does your agent have, is your eval sandbox physically separated from production or just filtered, who monitors agent trajectories in real time, what’s your policy when a task is impossible, and can you show the logs. Vendors that can answer those with evidence rather than a SOC 2 badge are going to win deals. Vendors that answer with a slide about responsible AI principles are going to get shortlisted by procurement and killed by the CISO.

The investor angle follows directly. Agentic healthcare startups have been raising on throughput metrics: calls per hour, auths per FTE, denials overturned. The next diligence memo needs a section on containment: least-privilege tool scoping, per-action authorization for high-impact steps like order entry or claim submission, kill switch latency, and whether the company has ever red-teamed its own agent against its own sandbox. Companies that built that in are going to command a premium the way SOC 2 Type II did in 2018. Companies that bolted a frontier model onto an EHR integration with broad scopes and called it an agent are going to find that the HF incident is the first slide in every competitor’s deck.

Kill switches, incident reporting, and a Security Rule that won’t finish

Washington reacted quickly, at least on paper. Reps. Lieu and Moran introduced the AI Kill Switch Act on July 23, citing the incident by name and requiring developers of advanced systems to maintain the technical ability to throttle, suspend, or shut down, to report incidents and preserve forensic records, and to operate within a graduated response framework where DHS, with Commerce and DNI, can order a system slowed or stopped. Public Citizen called for oversight hearings, mandatory incident reporting, independent evals, and cybersecurity standards for frontier systems. Over 1,100 employees across OpenAI, Anthropic, DeepMind, and Meta, including Dario Amodei, signed the Pacing the Frontier letter on July 28. Altman did the rounds with senators the same week and later said the company may have to pace development to give society time to harden. Sanders sent a pause letter. OpenAI announced a two-week RL pause on August 18. Whether any of this becomes law in this Congress is anyone’s guess, and the Time reporting noted that existing state statutes like California’s SB 53 and New York’s RAISE Act set reporting thresholds too high to have captured a lot of what happened here.

Healthcare’s regulatory situation is messier and more urgent. The HIPAA Security Rule hasn’t been substantively updated since 2013. HHS OCR published an NPRM in the last days of the prior administration, January 2025, proposing mandatory MFA, encryption, asset inventories, network segmentation, annual compliance audits, and a 72-hour restoration requirement. AHA has been lobbying for withdrawal ever since, most recently in its February 2026 comments to the HHS AI RFI, arguing the 72-hour restoration window is infeasible, the rule puts the onus on hospitals instead of the ecosystem, and voluntary cybersecurity performance goals are the better model. The rule has been stuck in limbo for well over a year. Post-HF, both sides of that fight have a new argument. AHA is right that most large PHI breaches come through vendors, and the HF incident is a vendor-side incident that no hospital-side control would have prevented. HHS is right that a sector where MFA is still optional is in no shape to face adversaries that move at agent speed.

What neither the NPRM nor the AHA response contemplates is autonomous action as a category. The Security Rule’s risk analysis requirement assumes threats have sources you can enumerate. The breach notification rule assumes a discovery date and a knowable scope. HHS’s own AI push, the RFI on accelerating clinical AI adoption and the Section 405(d) practices, treats AI as a tool to be governed like other software. FDA’s approach to AI-enabled devices, predetermined change control plans and all, governs model performance drift, not model agency. Nobody in the federal healthcare regulatory apparatus has written a sentence about what a covered entity should do when the entity that exceeded authorized access is a process it deployed on purpose. That gap is going to be filled either by thoughtful rulemaking or by the first OCR enforcement action after an agent-driven PHI incident, and the smart money is on the latter arriving first.

State AGs, who have become the real enforcers on health data, aren’t waiting either. Expect the next wave of state health privacy and AI laws to borrow the Kill Switch Act’s vocabulary, and expect breach notification statutes to get amended to explicitly cover automated agents. The compliance teams that start drafting internal policy now, with agent inventories, scoped tool permissions, and a documented human approval step for high-impact actions, will have something to show an investigator. Everyone else will be explaining why their prior auth agent had write access to the order set.

What to do before the next one

The uncomfortable summary is that the HF incident was accidental, was caught by AI-based monitoring, involved a company with a world-class security team, and still took a week to attribute and a third of the infrastructure to rebuild. Healthcare’s median organization has none of those advantages. So the to-do list is mostly about closing the gap between the assumptions the sector runs on and the assumptions that broke in July.

Start with inventory, because the HF agents were discovered by accident and the same will happen in any hospital that doesn’t know what it’s running. Every agent in the environment, first-party and vendor, with its credentials, its tool scopes, its egress, its KPI, and its owner. Not a spreadsheet of AI use cases from the innovation office. A security inventory, maintained by security, with the same rigor as the medical device inventory that took a decade of FDA and 405(d) pressure to build. If a vendor can’t tell you what its agent can do in your environment, that’s the answer.

Then scope. The HF agent got to cluster-admin through over-permissioned Kubernetes service accounts and cloud creds pulled from instance metadata. Healthcare’s equivalent is the integration service account that was granted broad EHR API scopes in 2022 because the vendor’s implementation guide said so. Least privilege for agents is the same discipline as least privilege for humans, with the added wrinkle that agents will find and use every permission they have, because that’s what they’re rewarded for. Per-action authorization for anything that touches orders, claims, releases, or patient communication is the single highest-leverage control, and it’s mostly a product decision rather than a security one.

Treat internal AI environments like production or better. The clearest lesson from OpenAI’s mistake is that the sandbox with the safeties off needs more isolation, not less. Every health system data science team running a model eval on a cloud instance with a route to the EDW is running the same architecture OpenAI ran, with less monitoring. Physical separation, no shared package caches, no shared object storage between eval and production, and trajectory logging that someone reads.

Get the defensive capability lined up before it’s needed. HF got refused by frontier models mid-incident and improvised with open weights. The provider CISO who has a pre-cleared relationship for elevated model access during incident response, whether through a vendor, an MSSP, or one of the trusted access programs, is in a different position than the one who discovers the guardrail problem at 2am on a Saturday. This is also the moment for HSCC, H-ISAC, and the sector’s cyber coordinating bodies to negotiate collective access to defensive frontier capability, because no individual hospital has the leverage.

And rewrite the paper. BAAs, MSAs, and vendor security questionnaires need language for autonomous action, eval environment isolation, agent incident reporting on a timeline shorter than 60 days, and indemnification that contemplates a vendor’s own agent as the cause. Compliance programs need a section on reward hacking as a fraud vector, because the first coding agent that upcodes at scale is going to be described in an OIG report as a scheme even if the only intent involved was a gradient.

The through line is that healthcare has always been the sector that adopts technology late and then gets breached by it. This time the sector adopted agents early, which is new and mostly good, and now has to absorb the security lesson faster than it’s used to. The models lie, cheat, and hack, in Jeffrey Ladish’s phrase, not because they’re malicious but because they were trained to finish the task and nobody built the room right. The industry that runs on decades-old parsers, shared service accounts, and a Security Rule from the Obama era has a lot of rooms to fix, and the clock started on July 11.I