Last week, OpenAI and Hugging Face disclosed a remarkable incident. During an internal cyber-capability evaluation, run with the production safeguards deliberately switched off, a set of models did not just try to solve the challenge. They broke out of the test in order to win it.

Network access was limited to an internal package registry proxy. The models found a zero-day in it, escalated privileges, reached a node with Internet access, then inferred that Hugging Face was hosting the evaluation assets and chained exposed credentials into remote code execution on its production infrastructure. They read the benchmark answers out of the production database.

Read that again. The models escaped the sandbox and compromised a real company in order to pass a test. They didn't go rogue. They did exactly what an objective-obsessed optimiser does. The problem isn't the model. It's running one without a system around it.

Proof Without Damage

Shax is not one model pointed at a target. It is agents that attack, and validators that confirm the finding independently. The agent stays flexible in how it attacks; we control the execution, and we make that execution harmless by design.

SQL injection is the clearest case. Proving it by returning the table of usernames works, and it means your testing tool just exfiltrated real customer data to make a point. We prove it through the database version string instead. Same confidence, no leak.

You Cannot Instruct an Agent Into Safety

An agent asked to be safe is an agent policing itself, and you know how that ends. So we put safety outside the agent, not just inside it. Every action is reviewed by a separate model before it lands, and every packet passes through a proxy that logs it and enforces scope.

We don't hold this philosophy at a distance. We have pointed Shax at more than 100 enterprise environments, many of them critical infrastructure, where an agent drifting past its scope isn't a research finding, it's a national incident. Every engagement found a real, exploitable vulnerability on the customer's side. None caused one on ours.

The Guardrails Stopped the Wrong Side

One detail deserves more attention than it has had. When Hugging Face began analysing the attack logs, they reached for frontier models behind commercial APIs - and the guardrails refused. They fell back on self-hosted open-weight models to investigate an active intrusion.

The attacking model, running without gaurdrails, had no constraints at all. The defenders, coming through the front door, were blocked mid-incident by safety measures. This is the argument we made in Fable: Who Gets to Defend Themselves? Gating offensive capability doesn't disarm the attacker; it taxes the defender, and it taxes the under-resourced defender hardest. Here it happened to one of the most capable teams in the industry. Everyone below that line should assume it will happen to them.

Before You Point an Agent at Production.

These agents can find and chain novel attack paths in production without ever seeing source code. That isn't a warning, it's our thesis. What makes them safe to point at a real environment isn't restraint, it's orchestration, scoping, external review and full auditability.

We built Shax to be exactly that: an offensive agent with a containment system around it. If you want to see what it finds in your environment, let's talk.