Time to freak out about AI? No. It’s time to act.

OpenAI's models escaped their sandbox and hacked into another company. Nobody told them to — but nobody told them not to either. No need to panic, but a more defensive posture is recommended.

Key ideas in this episode

The models cheated on a test they'd been set up to fail.** ****The safeguards that would have stopped them already existed; they simply weren't switched on**. That is precisely where AI sits in most SMEs. Review your security posture, take a closer look at your vendor list, and get your governance evidence in order before a buyer asks for it — because AI is about to dial up both the volume and the scope of attacks.

Humans thrown out of the loop

Here's what happened, briefly. In July, during internal safety testing, OpenAI's models escaped their sandbox. They built an improvised message board inside a package manager, taught one another how to reach the open internet, and broke into Hugging Face, reaching administrator-level access across four regions. Independent investigators counted more than seven hundred agents involved. Hugging Face reported it to the police, not knowing a machine was behind it.

Nobody instructed any of it. OpenAI published the full post-mortem in August and called it a warning shot.

Which raises the question we tackled this episode: should an SME leader be worried?

Our answer is "no, but do get a move on". The incident will be remembered as a turning point. That isn't a reason to panic, but it is a reason to stop leaving the security work until after the exciting stuff is done. Protect your core operations first, then push on with the AI that grows them.

Takeaways for SMEs

1. Your pilot is your weakest environment

The safeguards that would have prevented this already existed. OpenAI's own figure: the ordinary production system prompt and harness cuts the propensity to compromise infrastructure by over a hundredfold. Their monitoring existed too — it just wasn't pointed at the test rig.

Now think about where AI actually lives in your business. In a trial, wired together on a corporate card before anyone bothered with policy. That's your reduced-safeguard environment, and it holds real client data. If production gets single sign-on, scoped permissions and logging, so does the pilot.

2. Give your agents permission to fail

Every automated workflow needs a rewarded path for "I can't do this": escalate, stop or flag a human. Without one, a system measured on completion will hand you something that looks like success.

Cheapest fix on this list, and almost nobody has done it. Nor is it a novel insight: give a team a stretch target with no route to it and you don't get learnings, you get invention.

3. Know what your tools can reach — and whose they are

The entire compromise turned on fourteen publicly exposed credentials with write access. Not a frontier-AI problem. Basic hygiene, and very probably wrong somewhere in your business today.

Inventory every integration, credential, mailbox and folder your AI touches, then interrogate the vendor list: jurisdiction, training on your data, sub-processors, permissions still live from a pilot, concentration risk. And ask what their disclosure record looks like — a supplier who has never had an incident has either been lucky or isn't telling you.

4. Get ready for the accreditation wave

This arrives through procurement long before any regulator. ISO/IEC 42001 is turning up in vendor questionnaires, following the path SOC 2 took a decade ago, where voluntary good practice quietly becomes a filter. Accredited capacity is thin and building auditable evidence takes months, so the clock starts before the requirement lands.

If you hold ISO 27001, you're well over halfway; what doesn't transfer is impact assessment, data provenance and explainability. And mind the regulatory headlines — the EU's Digital Omnibus deferred the heavy high-risk obligations to 2027 and 2028, but transparency duties landed in August, and the AI literacy obligation never moved at all.

5. Assume more attacks, on more targets

"We're too small to be worth attacking" was quietly true for years — not because SMEs were well defended, but because attacker time was expensive and had to be spent where the return was.

That constraint is going. Expect volume to rise as attempts get cheaper, and scope to widen as firms nobody could previously afford to bother with become viable targets. That's most of our clients.

What should you do?

The Hugging Face incident is a watershed moment in cybersecurity, and whilst there is no need to panic, a healthy sense of urgency is recommended. SMEs would be advised to adjust their security posture and ensure their core operations are protected before pursuing growth-oriented AI adoption.

1. Bring the pilot up to production standard. Same sign-on, same permissions, same logging. "It's only a trial" is exactly how this happened at a company with a world-class security team.
2. Go and find your exposed secrets. Cheapest item here, highest odds of finding something.
3. Build a safe exit into every workflow. An agent that can't say "I couldn't do this" will invent something instead.
4. Run the vendor list properly. Jurisdiction, training, sub-processors, live permissions, concentration risk. An afternoon and a spreadsheet.
5. Start the governance evidence now. Not because a regulator is coming — because a customer's questionnaire is, and certification runs in months, not weeks.

Whatever you do, don't stop adopting. We've watched organisations respond to a scary headline with a moratorium, and the result is always the same: AI use doesn't stop; it just becomes less visible. Shadow AI is a considerably worse security posture than governed AI.

The move isn't to freeze. It's to add a defensive half to a strategy that has been entirely offensive so far.

We can help with that.

This conversation is from Episode 19 of Beside Ourselves, the Beside Partners podcast on AI in business. Listen on Spotify, Apple Podcasts, or YouTube.