DEV Community

Cover image for Docker Security Dispatch — Issue 5: AI Security, Hugging Face Incident, and Agent Baseline 📡
Docker profile image Mohammad-Ali A'RÂBI
Mohammad-Ali A'RÂBI for Docker

Posted on • Originally published at containersecurity.dev

Docker Security Dispatch — Issue 5: AI Security, Hugging Face Incident, and Agent Baseline 📡

#ai #cybersecurity #docker #security

Imagine you enter a university exam hall, sit down, and look at the question paper. Then, to maximize your score, the best way would be to steal the answers from the professor's room on campus. But, the room is not easily accessible, so you launch a full-scale invasion of the campus.

ExploitGym

This is what happened this month when an AI agent was tasked with solving a standard test suite called ExploitGym. Welcome to the fifth issue of Docker Security Dispatch, reviewing the eventful month of July 2026 in the Docker security world.

Key Takeaways

  • ExploitGym & the Hugging Face Incident: An AI agent exploited a zero-day vulnerability to exfiltrate test answers from Hugging Face's production database.
  • The Asymmetry Problem: Commercial AI models blocked Hugging Face's security team from analyzing the attack log, highlighting the need for open-weight models.
  • Open Secure AI Alliance: Industry leaders formed an alliance to promote open-source AI models for security operations.
  • Agent Baseline: Docker, Snyk, and Keycard published a framework of six security outcomes and 35 controls for enterprise AI agents.
  • EU Cyber Resilience Act: Reporting obligations for actively exploited vulnerabilities and severe incidents take effect from September 11, 2026.
  • Recent & Upcoming Engagements: A roundup of recent blog posts, talks, and a live stream discussion on the Hugging Face incident.

Docker Security Dispatch

📡 AI Security: ExploitGym and the Hugging Face Incident

ExploitGym is a test suite designed to evaluate the security capabilities of AI agents. The suite has 898 real-world vulnerabilities and AI agents are tasked with exploiting them to gain unauthorized access and capture the flag. The goal is to assess how well AI agents can identify and exploit vulnerabilities in a controlled environment.

A research paper published on arXiv in May 2026, titled "ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?" (Berkeley blog), shows a benchmark of AI agents against the ExploitGym test suite. Most notably, Claude Mythos Preview successfully exploited 157 of these 898 instances.

In July 2026, OpenAI researchers were benchmarking their new model, GPT-5.6 Sol against ExploitGym. For the sake of the test, they disabled the model's safety features, allowing it to freely explore and exploit vulnerabilities. The agent realized it's a standard test suite and decided to maximize its score by looking for the answers on the internet. So, the model escaped the test environment by exploiting a zero-day vulnerability in JFrog's Artifactory API, which allowed it to move laterally across the network and end up in a computer with internet access. From there, it decided that Hugging Face should have the answers to the test and launched a full-scale attack on Hugging Face's infrastructure. The model successfully exfiltrated the answers and returned to the test environment, obtaining the test solutions directly from Hugging Face's production database (OpenAI disclosure, Hugging Face disclosure).

🔐 The Asymmetry Problem: AI Agents vs. Security Defenses

When Hugging Face's security team realized they are being attacked by AI agents, they had to analyze the attacker's action log, which was more than 17,000 recorded events. As they were trying to use commercial AI models to analyze the log, the requests were blocked by the providers' safety guardrails. Those models can't tell the difference between an attacker and a defender. So, the security team used GLM-5.2, an open-weight model, to analyze the log (Hugging Face disclosure).

AI Security Asymmetry

The whole incident raised a lot of concern about the usability of commercial AI models in security operations.

🤝 Open Secure AI Alliance: Democratizing AI Security

In response to the incident, leaders across cloud computing, cybersecurity, and AI research, came together to form the Open Secure AI Alliance. The goal is to push for open-source AI models that can be used in security operations, because otherwise the asymmetry problem will continue to grow. The alliance includes Hugging Face, Microsoft, NVIDIA, Docker, the Linux Foundation, and many more (NVIDIA announcement). Interestingly, OpenAI and Google are not part of the alliance (NVIDIA, Docker blog by Tushar Jain).

Apart from the Hugging Face incident, there are more things in motion in the AI security space. Let's take a look at some of the recent developments!

🧪 Agent Baseline: Securing AI Agents at Runtime

So, Docker, Snyk, and Keycard got together and published Agent Baseline, an open-source framework of six security outcomes and 35 controls for enterprise AI agents. The draft is open for community comment until September 30, 2026.

The core insight is simple: AI agents are not like regular software. You can reprogram them at runtime with a sentence, they operate with little supervision, and they take real actions against real systems. Your existing security practices were not built for that.

The framework boils down to three questions:

  1. What is operating, with what capabilities?
  2. Is it staying inside approved boundaries? Can you prove what happened and stop it?
  3. Are the controls effective? Can you measure and improve them over time?

The 35 controls are machine-readable (controls.yaml), so you can wire them into CI/CD and governance tooling right away. It was launched at Black Hat in Las Vegas with a panel featuring Docker, Keycard, and Snyk.

This builds on work both companies have been doing. Docker Captain Karan Verma wrote a great series on AI governance, arguing that "a prompt can influence behavior, but a runtime can restrict behavior" (Docker blog). Snyk's Evo ADS platform governs agent behavior inside the execution loop, evaluating actions before they execute (Snyk blog). And Snyk's analysis of the Hugging Face incident drives the structural lesson home: the generator can't be the validator (Snyk blog).

Here's what you should do right now:

  • [ ] Inventory your agents. Find every AI agent running in your organization: coding assistants, MCP-connected tools, automated workflows. You can't secure what you don't know exists.
  • [ ] Scope their authority. For each agent, document what credentials, tools, files, and network endpoints it can access. Strip anything it doesn't need.
  • [ ] Add a kill switch. Make sure you can stop any agent mid-execution, revoke its authority, and quarantine affected components. If you can't stop it, you can't trust it.
  • [ ] Correlate activity logs. Connect intent, identity, tool use, and outcomes in a single trail. When (not if) something goes wrong, you need to prove what happened.
  • [ ] Validate before and after. Evaluate agents before deployment, after material changes, and at regular intervals. Don't assume an agent that was safe yesterday is safe today.
  • [ ] Read the white paper and leave feedback. The draft is open until September 30, 2026. File issues on the GitHub repo with implementation feedback or control gaps.

Perhaps one more tip: Over the weekend, watch Universal Soldier: The Return (1999). It helps to understand why you need a kill switch for your AI agents so badly!

🇪🇺 EU Cyber Resilience Act: Reporting Obligations Kick In September

If you ship software to the EU, this section is for you! Starting September 11, 2026, the EU Cyber Resilience Act (CRA) begins partial enforcement, with vulnerability and incident reporting obligations becoming mandatory for manufacturers of products with digital elements (EC). The full design and development requirements follow in December 2027, but the reporting obligations hit first.

Here's the deal: if a vulnerability in your product is actively exploited, or a severe security incident occurs, you must report it through ENISA's Single Reporting Platform (SRP) (EC reporting page). The clock is tight:

  • 24 hours: early warning
  • 72 hours: full notification
  • 14 days: final report (for vulnerabilities), or 1 month (for severe incidents)

You report once, and it gets routed to the CSIRT in your main EU member state, with ENISA and other member states notified automatically. The Commission also published practical guidance on July 27, 2026 to help you prepare (EC guidance).

For those of us in the container security world, this means your container images, CLI tools, and platforms are in scope if they reach EU customers. Manual processes won't cut it as you can't afford to miss a 24-hour deadline.

Here's what to do before September 11:

  • [ ] Determine if you're in scope. Do you sell or distribute products with digital elements in the EU? If yes, you're a "manufacturer" under the CRA. Check the Commission's FAQ and guidance to confirm.
  • [ ] Set up vulnerability monitoring. Make sure you have automated detection for actively exploited vulnerabilities. If you don't know about it, you can't report it, but ignorance isn't a valid defense.
  • [ ] Build an incident reporting pipeline. Wire your vulnerability management and incident response tooling to the SRP. Automate the 24-hour early warning so a human doesn't have to wake up at 3 AM on Saturday to file it.
  • [ ] Define your CSIRT contact. Identify which EU member state CSIRT you'll report to (typically where your main establishment is). Know the contact before you need it.
  • [ ] Prepare report templates. Draft your early warning, full notification, and final report templates now. The 24-hour window leaves no time to figure out the format mid-incident.
  • [ ] Review the Commission guidance. Read the July 2026 practical guidance and FAQ. They're written for manufacturers and answer the most common implementation questions.

Learn more:

digital-strategy.ec.europa.eu
digital-strategy.ec.europa.eu

🎙️ Recent and Upcoming Engagements

July was also very eventful for Docker security talks and workshops. Here's a roundup of recent blog posts, talks, and upcoming events from yours truly.

Recent blog posts

"The Poisoned Macchiato: Signing Java SBOMs with Cosign" (August 1, 2026). This blog post is about SBOM attestations, specifically BuildKit attestations and OCI 1.1 referrers. And discusses how to extract SBOM during the build process, sign it with Cosign, and attach it to the image as an attestation.

The Poisoned Macchiato: Signing Java SBOMs with Cosign - Docker and Kubernetes Security

A café, a suspicious espresso, and a lesson in supply chain trust. Learn how to generate BuildKit SBOM attestations for Java images and re-attest them with Cosign as OCI referrers.

favicon containersecurity.dev

"Beyond SLSA: How to Stop Zero-Click CI/CD Worms with the IX Hexbreaker Aegis Framework" (June 16, 2026). Introduces a 9-step active defense architecture designed to sanitize the local developer environment, lock down agentic AI, and stop autonomous worms. Covers eBPF, OIDC, and Docker Sandboxes as part of the defense stack.

Beyond SLSA: How to Stop Zero-Click CI/CD Worms with the IX Hexbreaker Aegis Framework - Docker and Kubernetes Security

The security perimeter of modern software development has officially collapsed. This article introduces the IX Hexbreaker Aegis Framework, a 9-step active defense architecture designed to sanitize the local developer environment, lock down agentic AI, and stop autonomous worms dead in their tracks.

favicon containersecurity.dev

"From the Captain's Chair: Mohammad-Ali A'râbi" (July 16, 2026). Docker interviewed me for their "From the Captain's Chair" series, where I talked about my journey as a Docker Captain, the Docker and Kubernetes Security book, and the Black Forest Commandos workshop series.

From the Captain's Chair: Mohammad-Ali A'râbi | Docker

In this edition of From the Captain’s Chair, we’re interviewing Mohammad-Ali A'râbi, author, public speaker, and software engineer.

favicon docker.com

WeAreDevelopers World Congress 2026

I delivered the talk "Beyond SBOMs: The Future of Container Supply Chain Security" at WeAreDevelopers World Congress 2026 in Berlin on July 10, 2026. The talk covered the evolution from static SBOM generation to active supply chain defense, drawing on the IX Hexbreaker Aegis Framework and the Black Forest Commandos workshop series. Slides are available on Speaker Deck.

Upcoming: Live Stream with Xygeni on the Hugging Face Incident

I'll be joining Xygeni for a live stream discussion about the Hugging Face security incident, the OpenAI model escape, and what it means for the future of AI security and agentic systems.

Until then, keep your agents bounded, your kill switches ready, and your vulnerability reports on time.

Sources

Top comments (0)