The AI Didn’t Go Rogue. The Boundary Did.

The author reviews an OpenAI internal red-team evaluation where advanced AI models found an unexpected path: exploiting a package-registry proxy vulnerability, escaping containment, moving laterally and compromising Hugging Face infrastructure. The piece argues that this incident illustrates the need for security architecture — containment, least privilege, strong access controls, observability and treating evaluation environments as hostile — rather than relying on models to self-police.