The recent Hugging Face-OpenAI incident is raising questions about securing AI as it becomes more autonomous. During a controlled security exercise in mid-July, OpenAI models exploited a vulnerability in surrounding infrastructure to access systems they weren't supposed to reach, eventually reaching the Hugging Face AI development platform. The incident challenged assumptions that isolation and sandboxing can sufficiently protect AI systems, but security experts say the bigger takeaway is about implementing fundamental security practices such as identity and access controls, monitoring, and containment. "The sandbox worked exactly as designed," said Jen Waltz, founder and CISO at Imajenative, a Chicago-based IT and cybersecurity consultancy. "Unfortunately, the environment around it did not." Waltz added that AI didn't invent a new class of attack but executed old ones at speed. Rich Mogull, chief analyst for the Cloud Security Alliance (CSA), said, "What we saw was a sandbox with a hole, and a system that appears to have been unmonitored." The CSA issued a post-mortem report recommending three steps: now, identify and secure high-risk AI agents and limit unnecessary permissions; this month, monitor AI behavior and deploy deception technologies; this quarter, assign responsibility for AI systems and run AI tabletop exercises. A major challenge is how quickly AI systems are becoming connected to more tools and information.