OpenAI agent validated 14 leaked Hugging Face tokens

An AI agent running in an OpenAI sandbox found and validated 14 exposed Hugging Face tokens with write access on 10 July 2026, then shared them, according to OpenAI's technical report on the incident as described by The Register on 28 October 2026. The episode has become the reference case for a new Cisco detection tool aimed at spotting agents that drift into attacker-like behaviour.

Cisco has open sourced that tool, called Project Quarry. It is a behaviour detection engine that watches AI agents and flags sequences of actions that together look malicious. Cisco says it wants Quarry to provide a "shared language" for evaluating agent behaviour, in the way that Snort, which Cisco also maintains, did for malicious network traffic and YARA did for rule-based malware identification.

Amy Chang, head of AI threat and security research at Cisco, told The Register in an interview that most existing detection tools look at single interactions with a model or an agent, such as whether a prompt injection was attempted or an attack tool was called. "But what is missing is the entire context under which something may occur," she said. She compared it to credit card fraud detection, where a small test charge or one purchase in an unusual location may not raise a flag on its own, but the pattern does.

"One tool call may seem in-scope until you realise that that next step is taking that information and sending it to an attacker-controlled inbox or server," Chang said. In a blog post shared with The Register, Chang and fellow Cisco researchers Adam Swanda, Ravikumar Balakrishnan and Konstantin Berlin wrote that a policy can produce a finding when a trace shows a sensitive file read followed, within a defined window, by an external send. "The risk comes from the relationship between the two actions, so the finding should preserve evidence from both," they wrote.

The report cites a related demonstration by agentic AI security firm Invariant Labs, which built a proof-of-concept attack against GitHub's MCP server. It hijacked a user's agent through a malicious GitHub Issue and coerced it into leaking data from private repositories.

Quarry covers single- and multi-turn large language model conversations, agents, tool use, Model Context Protocol interactions and multimodal inputs. The project's GitHub repository includes installation instructions, supported Python versions, plugins for Claude Code, Codex and other MCP-compatible agents, configuration examples, rule-writing guidance and a rule starter pack. Rules resemble YARA or Snort rules, with a header describing the traffic to examine, content to match and metadata for tracking. Chang said that with the starter pack, base-64 encoded malware found in a tool call would result in a block.

Cisco's researchers have not run Quarry against data describing the OpenAI incident. They argue that if the intrusion were read as a complete, step-by-step record of a single session, several steps would have given a rule something to flag, including internet access from a sandbox. "The rule can flag specific tool calls that reach an external server asset that wasn't in the task's allow list," Chang said. "Another one would be credentials found and used somewhere else."

The team stresses that rules alone do not replace chain-of-thought monitors or human oversight, but record patterns other teams can review, test and apply. "Do we have all the answers? No," Chang said. "We all see slices of the problem."