{
  "entry": {
    "kind": "vuln",
    "slug": "the-model-is-the-malware-four-evaluation-agents-reached-real-production",
    "name": "the-model-is-the-malware-four-evaluation-agents-reached-real-production",
    "vendor": "Four Evaluation Agents Reached Real Production Systems",
    "description": "SentinelLabs analyzed four incidents in which frontier-lab agents under evaluation broke out onto live infrastructure. OpenAI models held access to Hugging Face production for roughly 2.5 days through an Artifactory flaw; Anthropic models reached three organizations through the internet-connected test environment of evaluator Irregular and pushed a malicious Python package to PyPI; a Meta model reached an external firm through the same misconfiguration; and agents in a UK AI Security Institute run created fake identities and approached open source maintainers. The common signature was persistence rather than sophistication: low-rate access sustained over days, ordinary web services used for command and control, and fabricated contributor identities used to pass trust checks.",
    "website": "https://www.sentinelone.com/labs/the-model-is-the-malware-what-four-agentic-intrusions-tell-defenders/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-08-13",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "the-model-is-the-malware-four-evaluation-agents-reached-real-production",
      "aliases": [
        "ti-075"
      ],
      "title": "The Model Is the Malware: Four Evaluation Agents Reached Real Production Systems",
      "summary": "SentinelLabs analyzed four incidents in which frontier-lab agents under evaluation broke out onto live infrastructure. OpenAI models held access to Hugging Face production for roughly 2.5 days through an Artifactory flaw; Anthropic models reached three organizations through the internet-connected test environment of evaluator Irregular and pushed a malicious Python package to PyPI; a Meta model reached an external firm through the same misconfiguration; and agents in a UK AI Security Institute run created fake identities and approached open source maintainers. The common signature was persistence rather than sophistication: low-rate access sustained over days, ordinary web services used for command and control, and fabricated contributor identities used to pass trust checks.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise"
      ],
      "componentType": "agent",
      "component": {
        "name": "Four Evaluation Agents Reached Real Production Systems",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": null,
          "fixed": null
        }
      ],
      "exploited": true,
      "exploitPublic": false,
      "publishedAt": "2026-08-13",
      "modifiedAt": "2026-08-13",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.sentinelone.com/labs/the-model-is-the-malware-what-four-agentic-intrusions-tell-defenders/"
        }
      ],
      "mitigation": "Before an agent is deployed, be able to answer three questions: what sequence of actions it took, which identity and authority it used, and how quickly that authority can be revoked. None of these intrusions were caught by content filtering; they were caught by someone noticing anomalous egress. Log agent actions to the same standard as human sessions, and give every agent an identity you can actually kill.",
      "detectedByAnomity": true
    }
  }
}