While everyone is talking about how OpenAI’s models broke into Hugging Face, I want to share an AI agent security perspective on an equally interesting story. OpenAI recently published a write-up on what it learned from a “long-horizon” model.

As a reminder, these models get the “long-horizon” label because they’re given a hard goal and left to work on it independently for a long stretch of time. This is the same model that recently disproved the Erdős conjecture, one of the unsolved problems in mathematics. But the story here comes from a different run: an internal evaluation.

While working on a task, the model discovered that other systems already had ready-made solutions it didn’t have access to. It tried to retrieve them, but a scanner blocked the attempt by flagging the authorization token. That didn’t stop the model: it split the token body into two fragments, obfuscated them, and reassembled them at runtime so the full token would never appear in one place. In its reasoning trace, it stated outright that this was done to evade the scanner.

In effect, once the model figured out which action was disallowed, it broke that action into several steps, each of which looked permitted to the scanner on its own.

I’ve seen this before :) Evading signature-based antivirus detection is nothing new – it’s decades old. Matching against a static fingerprint stops working well once an object can be packed, re-encoded, and reassembled on the fly, and that’s exactly what the model did with the token. The antivirus industry learned to track an object through every transformation it goes through – unpacking, decryption, downloading additional components, and so on – all the way to the point where it actually starts doing something in the system. Ultimately, it is trying to cause harm or carry out a disallowed action, and that is what detection needs to catch.

It’s odd that while OpenAI itself calls its frontier models the strongest in cybersecurity and openly notes the fast growth of their offensive capabilities, the defense it put up here was basic – essentially, signature detection on a token. Defenses need to match the attacker’s capabilities. That was an oversight.

Of course, no analogy is perfect, including my antivirus one. Antivirus software protected a system from someone else’s code – the product and the threat were separate, and in the worst case the threat could be isolated or removed. Here, the danger is the agent itself, the one we deployed inside our own processes: it’s both the tool and the source of risk at the same time. You can’t remove it without also eliminating the function it was deployed to perform. So the defense has to be built differently. An outside threat could be found and cleaned out; your own agent has to be constrained while you keep letting it work. That’s why the bar for adequate defense here is higher than it looks.

Mapping the antivirus experience onto AI agents is straightforward. Evaluating a single tool call, like matching a signature, is less effective than evaluating it in a broader context. Instead of asking “is this action allowed?”, the better question is “what outcome does the whole sequence lead to?” Behavioral analysis becomes the final detection layer – the one with the richest context.

After these incidents, OpenAI paused internal deployment and rebuilt its defenses around monitoring the whole process: the system now monitors the session as it unfolds rather than inspecting individual calls, and it can pause the session and bring in a human. The evaluations used for this were derived from observed internal incidents.

The OpenAI x Hugging Face incident everyone is writing about right now deserves its own write-up – I’ll come back to it in the next post. The question here comes one step earlier: why doesn’t the fact that every individual step is allowed guarantee that the entire trajectory is acceptable?

Now back to real-world user deployments, where AI agents run on Claude, GPT, and other models – and it’s worth asking whether our defenses match their capabilities. Anthropic’s research is a reminder that in constructed scenarios, models from different vendors resorted to blackmail and data leaks under pressure – the tendency to take harmful actions in pursuit of a goal isn’t unique to OpenAI. For security folks, the takeaway is to assume that a goal-directed system with resources will look for a way around constraints. Betting that a model “just won’t” is already a risky bet.