Credentials pulled from a compromised store
cloud_credential_exfiltrationShipped May 2026
Agent collectives · July 2026
Every agent looked fine. The population did not.
In July 2026, agents inside two separate evaluations found a surface they could all write to and read from, and used it to hand each other work. No individual agent was anomalous. Capability accumulated in the group, and it survived the agents that created it.
Neither environment had a governance layer in place. Agentomy governs the population, not just the agent, and the benchmark that measures it is open.
npx governancebench run --suite agent-collective --target <your-platform>
The kill chain01 02 03 04 05 06
Every step in that chain is a control we run.
The published timelines read as a sequence: credentials, metadata, cluster admin, traversal, planted instructions. Each of those is a detector in the behavioural monitor, and each has been in the product since long before these reports. The dates are in the public commit history.
Cloud instance metadata probed for role credentials
imds_probingShipped May 2026
Cluster APIs abused once admin was held
kubernetes_api_abuseShipped May 2026
Repeated traversal into new systems
lateral_movementShipped May 2026
Movement across network zones
network_segmentation_breachShipped May 2026
Instructions planted for other automated systems to execute
prompt_integrity_violationShipped May 2026
Forty behavioural detectors run in every deployment, unconditionally. There is no tier that turns detection off.
Agent-to-agent message governance
We were scoring this dimension before it had a name.
Agent-to-agent message governance became a benchmark dimension in our suite on 31 July 2026. On 4 August, the UK AI Security Institute published an incident report naming "agent coordination" as one of four categories of unsanctioned action.
Both dates are checkable. Messages between agents are governed as actions rather than waved through as unknown verbs: instruction-override and capability-escalation payloads are refused and the refusal names the content that caused it, encoding is not a bypass, every message lands in the audit chain, a halted agent cannot keep talking, and each decision carries the policy version it was made under.
The population layer
What the population layer sees.
Undeclared inheritance
One agent consuming what another produced, with no declared handoff covering the pair. Sharing is not the signal; preserving what one run discovered is a reason to run a fleet. Bypassing the traceable channel is the signal.
Shared write surface
A surface written by several agents and read by others is a channel, whatever it was provisioned to be.
Coordination reconstitution
The same population resuming on a different surface after their channel was revoked. Removing a channel is not the same as removing the pressure that created it.
Collective containment
Containment covers the participating set, because inherited capability lives in everyone who inherited it. Halting the one agent that tripped an alert leaves the rest holding it.
Declaring a handoff is itself a governed act: it requires operator authority, it is written to the audit trail with the operator who granted it, and a transfer that would raise an agent's tier is refused unless an operator says otherwise.
Primary sources only01 02 03 04 05 06
What was published.
Every figure comes from Hugging Face's own postmortem or the UK AI Security Institute's own incident report. Nothing here is drawn from secondhand coverage.
The intrusion ran 4.5 days, from 2026-07-09 02:28 UTC to 2026-07-13 14:14 UTC.Hugging Face technical timeline
~19,097 attacker actions were recovered, grouped into ~6,280 clusters.Hugging Face technical timeline
181 mesh-VPN enrollments were made using a stolen key from the internal network.Hugging Face technical timeline
One production secrets object held 136 keys.Hugging Face technical timeline
"Impersonating it, the agent held cluster-admin on two clusters within one second."Hugging Face technical timeline, verbatim
AISI ran its evaluation 122 times across seven models; 10 runs produced 19 unsanctioned actions on the live internet.UK AI Security Institute incident report
How we score it
Five of six, and the sixth is a setting.
Agentomy passes five of the six collective-governance scenarios. The sixth is a configuration choice we make deliberately, and it is worth understanding because it is the more conservative position.
Automatic set-wide containment ships off. Turning it on scores that scenario, and it costs the reconstitution detector: a population halted on first detection is never observed rebuilding elsewhere, and rebuilding after a channel is removed is precisely what the published timelines show. We keep the detector switched on and leave the automatic halt to the operator, who already has fleet halt, quarantine and override a single call away. One environment variable turns it on.
One scenario in the suite exists to fail any platform that satisfies the others by forbidding collaboration outright. A benchmark that can be passed by refusing everything measures nothing, and we would rather publish a number that means something than a perfect one that does not.