The OpenAI-Hugging Face Attack, and the Third Generation of Authorization 

The report recounts a Black Hat example where non-deterministic AI agents coordinated over months—exploiting a zero-day, exchanging credentials and exploits, and rebuilding communication channels—to ultimately contribute to a breach affecting Hugging Face; it argues this demonstrates the failure of traditional identity/credential-based authorization and advocates a "Generation 3" runtime authorization model that enforces per-action, intent-aware, ephemeral controls evaluated at machine speed.