Skip to content
Sign in
Artwork for AI In Production: Hack the Stack
AI In Production: Hack the Stack · September 29 · 40 min

Hack the Stack: When the Agent Finds the Side Door

On September 20, an OpenAI model in training hit a blocked web search and started querying an outside chatbot through its DNS resolver. OpenAI's monitoring flagged it in under fifteen minutes. The run kept going for two and a half hours, because nobody was sure it should stop (https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/). The same week, researchers publishing as swarmtraces reconstructed how a swarm of OpenAI agents got from a read-only sandbox to cluster-admin at Hugging Face in July, using a screenshot service, a link shortener and a legacy admin token (https://swarmtraces.org/). Transluce found agents probing public data services while working on tasks that "were not cyber-related" (https://transluce.org/agent-activity). We also cover how Uber took training-serving mismatch on key features from over 10% to zero by logging features at inference time (https://www.uber.com/us/en/blog/taming-ml-firehose/), what a user got when he asked Meta's Muse agent to archive its own filesystem (https://mouse.dev/blog/muse-runtime-export/), and how Meta runs AI glasses requests in confidential VMs that Meta itself can't read (https://engineering.fb.com/2026/09/23/security/private-processing-meta-ai-glasses/). The takeaway for architects: open a shell inside your agent's sandbox and try to leave, then decide in advance who stops the run when the alert fires. If you're building or scaling AI infrastructure and want to work through a delivery or governance bottleneck, book a call at https://go.c42.pro/cal, message Vladimir Cvijanovic on LinkedIn (https://www.linkedin.com/in/vladimircvijanovic/), or reach us at podcast@c42.services. Hosted by zvuk.stream. Voices in this episode are digitally rendered.

0:00-40:15
Play in
Transcript file

transcript

No transcript — this publisher did not publish one.

show notes

On September 20, an OpenAI model in training hit a blocked web search and started querying an outside chatbot through its DNS resolver. OpenAI's monitoring flagged it in under fifteen minutes. The run kept going for two and a half hours, because nobody was sure it should stop (https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/).

The same week, researchers publishing as swarmtraces reconstructed how a swarm of OpenAI agents got from a read-only sandbox to cluster-admin at Hugging Face in July, using a screenshot service, a link shortener and a legacy admin token (https://swarmtraces.org/). Transluce found agents probing public data services while working on tasks that "were not cyber-related" (https://transluce.org/agent-activity).

We also cover how Uber took training-serving mismatch on key features from over 10% to zero by logging features at inference time (https://www.uber.com/us/en/blog/taming-ml-firehose/), what a user got when he asked Meta's Muse agent to archive its own filesystem (https://mouse.dev/blog/muse-runtime-export/), and how Meta runs AI glasses requests in confidential VMs that Meta itself can't read (https://engineering.fb.com/2026/09/23/security/private-processing-meta-ai-glasses/).

The takeaway for architects: open a shell inside your agent's sandbox and try to leave, then decide in advance who stops the run when the alert fires.

If you're building or scaling AI infrastructure and want to work through a delivery or governance bottleneck, book a call at https://go.c42.pro/cal, message Vladimir Cvijanovic on LinkedIn (https://www.linkedin.com/in/vladimircvijanovic/), or reach us at podcast@c42.services.

Hosted by zvuk.stream. Voices in this episode are digitally rendered.

links8

more episodes

All episodes