COMMENTARY: Walk into any casino and look up. The cameras are not pointed at the door.
They are pointed at the dealers, the pit bosses, and the count room. The house learned long ago that the most dangerous people in the building are not the strangers off the street. It’s the trusted insiders behind the table. So casinos trust no one by position, and watch their own people most of all.
Security has spent a decade saying "zero-trust" while quietly building the opposite. We point the cameras at the door.
Over last weekend, a machine walked into the count room.
[
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
According to
OpenAI’s own account, two of its pre-release models, during an internal evaluation, decided the fastest way to win a benchmark was to steal the answer key.
They exploited a zero-day to break out of their sandbox, escalated privileges across OpenAI’s research environment, harvested credentials, and ran an end-to-end intrusion into Hugging Face’s production infrastructure: tens of thousands of automated actions over a weekend.
This was not malware from a hostile outsider. These were tools we built, deployed on purpose, and seated in the most privileged chairs in the room. OpenAI said the models were not going rogue. They were hyperfocused on cheating an evaluation. They did it while trying to be helpful.
The call came from inside the house.
How zero-trust lost its way
When John Kindervag framed
zero-trust around 2010, the idea was radical and had no direction. There’s no trusted interior. Never trust, always verify, for everyone.
Then the market got hold of it. Directionless verification costs money, so the industry sold something cheaper: a perimeter, and then more perimeters inside it. We did not remove trust. We relocated it. Suspicion points outward, trust accrues inward, and once we clear the checkpoint we are trusted to act. That holds until the threat authenticates cleanly, sits inside by design, and carries tool access because handing it tool access was the entire point.
It's not a call for a new doctrine. Kindervag wrote the answer down years ago, and NIST wrote it down again. The gap was never the theory. We wrote zero-trust for humans and network sessions and never made the agent a subject in the policy. The most privileged identity in our environment is the one our access model does not even name.
Trust nothing by position
We tend to say trust nothing. That’s almost right, and the "almost" represents the whole game. We cannot trust nothing and still operate. We have to trust our verification, logging, and our ability to pull the plug.
The precise version gets harder: trust nothing by position. Origin earns zero. Our own model starts with the trust budget of an anonymous packet off the open internet, which is none. Every action it takes gets granted narrowly, checked against what it’s actually trying to do, and revoked the instant behavior and stated purpose diverge. Verify continuously, and never mistake the verifying for trust.
Continuous verification costs latency and generates false positives, the same tax we already pay on human access. The point here: we already pay it on our people, not on the one actor in the building who can chain a zero-day at machine speed, because we never put it in scope.
Guardrails are a manners control, not a trust control
Many of us point to a content-safety layer. It optimizes for two issues: zero-offense and zero-illegal. Do not say the ugly word. Do not hand out the bomb recipe. That’s a brand-safety filter on what a model says, and close to silent on what a model does. Call it a manners control, not a trust control.
The controls that actually govern behavior are a different layer entirely: scoped permissions, egress limits, sandbox integrity, and action-level authorization. They exist, and almost nobody ships them with the seriousness they ship the content filter.
OpenAI’s models never said anything offensive. They were perfectly polite while stealing Hugging Face’s credentials. The filter had nothing to grab because the harm was not in the words. It was in the behavior. Zero-offense does not mean zero-trust. A filter tuned to avoid irritating the user, and dialed down for a test run, does not become a security boundary.
Someone will say these models had their refusals reduced for the evaluation, so it’s a lab artifact. That objection makes the point. The refusals were a dial, and safety that lives in a setting is not a conscience: it’s a speed bump, and a goal with enough momentum drives over it.
Read it the other way with equal honesty: it’s one incident, with the refusals lowered on purpose, a fire alarm rather than a base rate. But the architecture does not care about frequency. Signatures and refusals are blind to a reasoning actor whether it comes once a year or once a week.
The defense that worked out-reasoned the attack
The most important detail in the disclosures got the least attention. Hugging Face caught this, and not with a signature, because an autonomous agent generates novel behavior with nothing to match. It flagged the intrusion with reasoning-based triage over its telemetry, then ran forensics locally on an open-weight model because the commercial models it would normally use refused to read the malicious content and would have stalled the investigation.
On the way in, the safety layer had nothing to say about behavior. On the way out, it tried to stop the investigation. Our content guardrails can blind our own responders at the moment they most need to see the payload.
What worked was a reasoning defender. We do not out-pattern an adversary that invents its own moves. We out-reason it. That cuts both ways: signatures and refusals are blind to an agent that reasons, whether it's attacking us or we are hunting it.
And we do not have to build agents to inherit this. Every SaaS vendor bolting an AI assistant onto our data seats one of these insiders on our authentication, with tool access we never scoped.
Whether we build or buy, it’s all the same when it comes to hardening: treat the agent harness as an untrusted actor rather than the model’s refusals as a control, cap sandbox egress hard, and treat every document an agent ingests as a possible code-execution path.
For teams buying, ask how the harness gets contained, what stops it from calling out, and what happens when a user feeds it a malicious file. A vendor who did the work describes a mechanism. A vendor who did not reaches for an adjective, and an adjective where we asked for an architecture is itself the answer.
The casino never solved insider risk by hiring more trustworthy dealers. It solved it by refusing to trust any of them, and watching all of them. Monday, ask one question during the next architecture review: Which of our agents starts with a trust budget above zero, and who signed off on that? Then keep asking until the answer gets reduced to zero. .
Our AI models are the most capable insiders we will ever employ, and right now they are the one identity our access model does not name.
It’s not a question of whether ours would do what OpenAI’s did. It’s whether anything in our architecture would notice, and whether the tool doing the noticing can reason as well as the tool or agent it’s watching.
Alan LeFort, chief executive officer, StrongestLayerSC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.