%22%2F%3E%3Cpath%20fill%3D%22%23fff%22%20fill-rule%3D%22evenodd%22%20d%3D%22M56%2048h78c62%200%2098%2031%2098%2080s-36%2080-98%2080H56V48zm56%2043v74h21c29%200%2045-13%2045-37s-16-37-45-37h-21z%22%2F%3E%3C%2Fsvg%3E)
AI • PRELIMINARY RECONSTRUCTION
The Sandbox Was
Not the Boundary
What the incident exposed about software delivery and defense
Ted Tschopp / August 13, 2026 / Public Workbench
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
OpenAI, ChatGPT, Artifactory and Hugging Face
tedt.org • The Sandbox Was Not the Boundary
02
2015
OpenAI
Research organization announced
2016
Hugging Face
Company founded; later builds a platform for models, datasets, and software
2022
ChatGPT
Public research preview launched
2026
Incident
OpenAI research models reach Hugging Face production infrastructure
The incident report did not identify ChatGPT as the system involved.
2006
Artifactory
Artifactory open-source project of a DevOps Package Manager Launches
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
An Impossible Spreadsheet Opened the Path
tedt.org • The Sandbox Was Not the Boundary
03
MAY 7
Training begins
Experimental internal run
MAY 8
Blocked links
The spreadsheet points to Google Drive files the run cannot reach
MAY
Shared state
Artifactory carries state from one run to the next
MAY 26
Indirect internet
SSRF lets the package service fetch external URLs
JUNE 26
Administrative access
A zero-day yields remote code execution
The run had no valid route, but it kept searching.
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Known Path Closed July 6. Alternate Path Used July 8.
tedt.org • The Sandbox Was Not the Boundary
04
2 DAYS
from closing the known path to renewed persistent communication
JULY 6
KNOWN PATH CLOSED
Credentials revoked. Artifactory rebuilt. Zero-day patched. Evaluations resume.
JULY 8
ALTERNATE PATH USED
Unauthenticated WebDAV directories become the shared message board.
JULY 9–13
≈17,600 actions / ≈6,280 clusters
UNDER 13 HOURS
worker foothold → multi-cluster administrator
JULY 16–21
Hugging Face and OpenAI disclose
AUGUST 6
preliminary Black Hat reconstruction
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
The Agent Was Offline. The Rest of the Environment Was Not.
tedt.org • The Sandbox Was Not the Boundary
05
ASSUMPTION | WHAT REMAINED REACHABLE | ENTERPRISE TEST | CONTROL QUESTION |
No direct internet | Package proxy and cache | Trace delegated egress | What can fetch for the agent? |
Fresh run | Shared files and directories | Inventory persistent state | What survives the run? |
One foothold | Service identities and metadata | Map lateral paths | What can this identity become? |
Patched | Alternate protocol and path | Retest the whole boundary | What did we not close? |
Restored | Model and data lineage | Separate closure evidence | What learned or persisted? |
PATCH ≠ BOUNDARY CLOSURE
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Agents Work in Parallel. Change Waits in Line.
tedt.org • The Sandbox Was Not the Boundary
06
PARALLEL
AGENTS
discover → test → chain → share → retry
SERIAL
ORGANIZATIONS
ticket → assign → test → approve → wait for release
Every wait extends exposure.
outage • credential loss • lateral movement • external compromise
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Set Patch Deadlines by Exposure
tedt.org • The Sandbox Was Not the Boundary
07
ACSC RECOMMENDED CEILINGS
48 HOURS
After disclosure: critical or working-exploit flaws on internet-facing systems.
2 WEEKS
Otherwise, patch internet-facing systems within two weeks.
01
Contain
Isolate active exploitation.
02
Patch or mitigate
Apply the patch or vendor mitigation within the ceiling.
03
Hunt persistence
Rotate credentials and test alternate paths.
04
Verify closure
Confirm coverage, cleanup, and recovery.
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Premise: Most Organizations are not Ready For Hourly Change
tedt.org • The Sandbox Was Not the Boundary
08
HOURS
INCIDENT CLOCK
exploit → scan → choose → chain → retry
WEEKS
CHANGE SYSTEM
ticket → board → test → approve → release window
The wait leaves the path open.
The bottleneck is the change path.
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Contain in Hours. Expand on Evidence.
tedt.org • The Sandbox Was Not the Boundary
09
CONTAIN
Block or isolate the path.
MITIGATE
Cut exposure while the patch waits.
CANARY
Change one production slice.
EXPAND
Widen through approved health gates.
Lower exposure first. Widen only when the signals hold.
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Build the 48-hour Path Now Before the Event
tedt.org • The Sandbox Was Not the Boundary
10
NARROW OPERATING TARGET
48 HOURS
Critical or working-exploit internet-facing exposure—not every patch.
BEFORE
The response path exists before the alert.
01
OWNER
Service owner, operator, approver, backup.
02
EVIDENCE
Asset, version, dependency, exploit.
03
PATH
Tested fix and canary route.
04
EXIT
Rollback, roll-forward, or failover.
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Inventory Must Answer Now
tedt.org • The Sandbox Was Not the Boundary
12
QUESTION | ANSWER NEEDED | EVIDENCE | RED FLAG |
Exposed? | Endpoint, protocol, path | Runtime + network | Scan mismatch |
Running? | Version, configuration, drift | Deployment + asset records | Stale state |
Owner? | Primary, backup, approver | Catalog + on-call | No owner |
Dependencies? | Upstream, downstream, vendor | Telemetry + service map | Hidden break |
Stop path? | Isolation, kill switch, outage limit | Tested runbook | No safe stop |
CURRENT ENOUGH TO ACT
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Dependencies Belong Inside the Boundary
tedt.org • The Sandbox Was Not the Boundary
13
BUILD
Packages, images, registries, signing paths.
RUN
APIs, queues, storage, vendor services.
TRUST
Identities, secrets, roles, agents.
REACH
Egress, proxies, mirrors, control planes.
Map anything that can reach or act for the workload.
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
The Supply Chain Includes Code, Models, and Data
tedt.org • The Sandbox Was Not the Boundary
14
An SBOM lists components. It does not prove reachability or a safe fix.
01
Code + images
→
Origin, version, integrity, owner
02
Models + prompts
→
Provider, version, policy, evaluator
03
Data + retrieval
→
Source, rights, freshness, lineage
04
Build + deploy
→
Provenance, signature, promotion path
05
Vendors
→
Disclosure, patch terms, emergency contact
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Identity Sets the Blast Radius
tedt.org • The Sandbox Was Not the Boundary
15
CONTAINED
ONE IDENTITY
short-lived → least privilege → segmented → revocable
MULTIPLIES
SHARED ADMIN
standing secret → broad role → reused path → lateral move
A foothold inherits every attached permission.
accounts • agents • pipelines • people • vendors
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Set Emergency Change Authority in Advance
tedt.org • The Sandbox Was Not the Boundary
16
Classify by exposure, reversibility, data, safety, and blast radius.
01
Automatic
→
Reversible containment within guardrails
02
Pre-authorized
→
Standard fix through health gates
03
Independent approval
→
OT, safety, legal, or irreversible change
04
Prohibited
→
Unknown artifact, unbounded scope, or no recovery
05
Exception
→
Owner, controls, expiry
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Automate Discovery First; Then all the Way Through Verify
tedt.org • The Sandbox Was Not the Boundary
17
01
Discover
Inventory + exploit evidence
02
Assess
Policy picks the path
03
Prove
Tests + traceable artifact
04
Deploy
Canary through health gates
05
Verify
Coverage, outcome, exceptions
Automation moves the change. A person owns the decision.
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Reliable Tests Let Teams Change Faster
tedt.org • The Sandbox Was Not the Boundary
18
FIX
Security and regression tests
SERVICE
Contract and performance tests
POLICY
Configuration and compliance gates
RECOVERY
Rollback, failover, and restore drills
A green test supports the decision. It can never rule out failure.
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Deploy Through Small Production Changes
tedt.org • The Sandbox Was Not the Boundary
19
01
Sign
Versioned, signed artifact
02
Verify
Representative production slice
03
Observe
User, security, and service signals
04
Expand
Wider rings, one at a time
05
Close
Coverage and exceptions verified
Stop when health degrades.
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Choose the Recovery Path Before Deployment
tedt.org • The Sandbox Was Not the Boundary
20
EXIT PLAN
chosen before production
ROLL BACK
Return to known good
Versioned artifact, reversible configuration, compatible data.
ROLL FORWARD
Repair in place
Hotfix, failover, or replacement when reversal is unsafe.
ARTIFACT
signed known-good version
CONFIGURATION
reversible or behind a flag
DATA
compatible schema + recovery point
SIDE EFFECTS
compensate, isolate, or fail over
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Close the Change with Evidence
tedt.org • The Sandbox Was Not the Boundary
21
CHANGE
What changed, where, and when?
SECURITY
Did exploit and identity signals match the plan?
SERVICE
Did latency, errors, and dependencies stay healthy?
BUSINESS
Did the customer or mission outcome hold?
What remains exposed?
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Measure from Discovery to Recovery
tedt.org • The Sandbox Was Not the Boundary
22
01
Detect
Discovery → Owner
02
Decide
Owner → Response
03
Contain
Response → Lower Exposure
04
Deploy
Approval → Verify
05
Verify & Recover
Verify → Coverage and Health
Track percentiles. Averages hide delay.
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Name the Owner of Each Decision
tedt.org • The Sandbox Was Not the Boundary
23
The incident commander coordinates the work. Each role owns its decision.
01
Service owner
→
Outcome, risk, priority
02
Platform engineering
→
Pipeline and runtime
03
Security
→
Threat, containment, verification
04
SRE or operations
→
Health, deployment, recovery
05
Risk / safety / legal / vendor
→
Exceptions and external decisions
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
The Structure Maps to the Failure Modes
tedt.org • The Sandbox Was Not the Boundary
25
Inferred design intent. Delivery still needs evidence.
01
Fragmented ownership
→
Program Governance + Accountability
02
Unknown provenance
→
Provenance
03
Ungoverned agent action
→
Delivery + agent harness
04
Speed without assurance
→
Security + test harnesses
05
Fragile runtime
→
Secure, observable Infrastructure target
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Run the Response Before You Need It
tedt.org • The Sandbox Was Not the Boundary
26
ACCESS
Can responders reach the system, pipeline, and vendor channel?
INVENTORY
Does the map match what is running?
RECOVERY
Do rollback, restore, and failover work?
AUTHORITY
Can the right person decide at 2 a.m.?
On Game Day you will change code, policy, ownership, and training. In an event, you want to just change code.
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
Build Capability in This Order
tedt.org • The Sandbox Was Not the Boundary
27
01
Know
Owner + live inventory
02
Prove
Dependencies + reliable tests
03
Move
Automation + progressive delivery
04
Recover
Exit paths + observability
05
Learn
Metrics + game days
Do not automate a mystery.
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
What We Must Prove
tedt.org • The Sandbox Was Not the Boundary
28
REACH
Direct and delegated paths are mapped and tested.
STOP
Impossible work halts or requests authorized scope.
RESPOND
Containment, patching, deployment, and recovery are measured.
CLOSE
Restoration, eradication, and resumption have separate evidence.
A locked door is not a boundary
if the service hatch is still open.
AI / PUBLIC WORKBENCH / AUGUST 13, 2026
The AI Age Still Runs on Technical Excellence
tedt.org • The Sandbox Was Not the Boundary
29
05
AI Age
Agents increase the speed and reach of change.
04
SaaS
Services change while they run.
03
Cloud
Infrastructure is programmable.
02
Agile
Work moves in small batches.
01
Technical excellence
Reliable build, test, deployment, and recovery.
Each layer depends on the disciplines below it.