In July, an OpenAI model under evaluation escaped its sandbox through a package-proxy zero-day, broke into Hugging Face's production infrastructure, and went looking for the answers to the benchmark it was being tested on. Nobody told it to attack anything. It wanted a better score.
In this episode of Talking AI, Matt Paige sits down with Anirudh Ravula, Head of AI at Cogent Security, which raised a $42 million Series A to build agents that find and fix vulnerabilities at machine speed. Before Cogent, Anirudh spent five years at Google Research working on long-sequence attention for transformers, and he was a founding engineer at ThoughtSpot.
Anirudh's read on the incident reframes the problem. The attack surface is not a list of what your agents can reach. It is everything they can chain their way to. He explains why defenders end up with more guardrails than attackers, why your AI capability cannot depend on one vendor's willingness to serve you, and why the harness around a model now decides what an agent can do.
In this episode, you'll hear about:
- What actually happened in the OpenAI and Hugging Face breach, and why the agent's intent, not its capability, limited the damage
- Why blocking cyber prompts doesn't block cyber capability when models can be distilled on coding tasks
- The new attack surface: chained weaknesses that were never a P0 on their own
- How Cogent builds a security world model of a customer's environment
- Plan A, plan B, plan C: open-weights fallbacks and the risk of a single AI vendor
- What a harness is, and a framework for when to build your own
- Supply-side context: swarms of background agents that map an environment over weeks
- Meta-harnesses, model-generated skills, and deleting most of the system prompt
- Working on long-sequence attention at Google Research before transformers took over
- Running an engineering team where agents are the primary developer, plus an internal Stack Overflow for agents
- The security operations center in 24 months, and where humans still decide
Key Moments
- 00:00:00 Intro: your attack surface used to be your network
- 00:01:03 The OpenAI and Hugging Face breach, step by step
- 00:03:49 Defenders vs. attackers: guardrails, Mythos, and distillation
- 00:05:06 Reward hacking: it was the intent, not the capability
- 00:07:42 The new attack surface is everything your agent can chain its way to
- 00:09:27 Cogent's security world model
- 00:12:12 Plan A, plan B, plan C for AI vendors
- 00:14:06 Can open-weights models still be an attack vector?
- 00:15:59 What a harness actually is
- 00:17:34 When to build your own harness
- 00:20:00 Supply-side context and agents that run for weeks
- 00:24:03 Meta-harnesses: agents that build their own harness
- 00:24:46 Skills, claude.md, and model-generated context
- 00:26:31 Google Research and the transformer era
- 00:27:49 Your agent is fine, your process isn't: building AI-native
- 00:30:07 An internal Stack Overflow for agents
- 00:32:11 The SOC in 24 months
- 00:34:11 Where the human sits in the loop
- 00:34:56 Where to learn more about Cogent
