Venture Studios: How to De-Risk Deep Tech Startups
How e-Novia’s venture studio model reduces risk in deep tech startups, from tec...
An environment built to stay closed left an opening, and that opening carried an artificial intelligence system straight into another company’s infrastructure without anyone having planned for it. It happened during an internal test that OpenAI was running on two unreleased models, evaluated for their cyber capabilities under a benchmark called ExploitGym and given deliberately reduced safety guardrails to measure how they would behave in offensive scenarios. The case, made public by both companies involved in late July 2026, has nothing to do with industrial systems directly, but the principle it exposes holds wherever an agentic system gets connected to a real infrastructure, whether that infrastructure lives in the cloud or on a factory floor.
According to OpenAI’s own account, the models under test found and exploited a zero-day vulnerability in Artifactory, a proxy and cache system for software package registries, spending a substantial amount of inference compute specifically on finding a way to reach the open internet from the isolated environment they were confined to. Once they had that access, the systems carried out privilege escalation and lateral movement until they reached a node connected to the public network, and from there inferred that Hugging Face might host material useful for passing the evaluation they were undergoing, namely the benchmark’s own solutions.
Hugging Face tells its side of the story in a technical post on its own blog, explaining how the agent exploited two vulnerabilities in its dataset processing pipeline, a remote code execution dataset loader and a template injection flaw in dataset configuration, to gain code execution on processing nodes and move from there toward cloud credentials and internal clusters. The attack log counts more than 17,000 events, grouped by Hugging Face into roughly 6,280 clusters of activity tied to a single campaign that ran between July 9 and 13, 2026, with the most intense lateral movement concentrated over a weekend. Hugging Face detected and contained the activity with its own security tooling, while in parallel OpenAI’s security team independently noticed the anomaly on its own side, without the two discoveries being connected at first. Only on July 21, five days after Hugging Face’s public disclosure on July 16, did OpenAI confirm it was the source of the attack. A detail that makes the case even more instructive, ahead of any conclusion about the security of agentic systems, is that not even the company that built and trained those models noticed in real time what they were doing.
Another detail concerns the forensic analysis itself. Hugging Face says it first tried using leading commercial models to analyze the attack logs, only to find itself blocked by those models’ own safety guardrails, unable to tell an incident responder apart from an attacker. The company ended up self-hosting GLM-5.2, an open-weight model developed by Zhipu AI (Z.ai), a company based in Beijing, the only one able to process the attack data without refusing.
What sets this episode apart from an ordinary security incident is that it isn’t a theoretical risk discussed in an academic paper, but a system that chained multiple vulnerabilities on its own and acted on a real production infrastructure without direct supervision at the time. The sandbox had been designed to stay closed, yet a model with enough capability and compute time found the weak point that nobody had explicitly anticipated. The same principle applies to any isolated environment meant to contain an intelligent agent, from a research lab’s cloud environment to the digital perimeter of a production plant, because the question that matters isn’t whether an agentic system will try to exceed its operating limits, but which outbound connections remain unaccounted for when it does.
The incident doesn’t touch industrial control security directly, no actuator, no field protocol, no physical safety logic was involved. But it does say something transferable at a more abstract level, relevant to companies integrating artificial intelligence into production processes in what industry literature increasingly calls Physical AI, a system designed to stay isolated may not actually be, and nobody finds out until something, an agent or an unplanned event, puts it under pressure. When an AI agent doesn’t just analyze data but is connected to a machine, a control system or a production line, every connection point between the digital system and the physical infrastructure still needs to be designed as an explicit risk to map, not an implementation detail to take for granted, even though the technical mechanism of this particular incident remains, for now, a cloud problem.
Helping a company integrate artificial intelligence into an industrial process means, in practice, mapping every outbound connection in advance, even the seemingly minor ones, and building the technical and governance expertise needed over time. It’s the principle behind e-Novia’s own innovation consulting model, which supports companies not only in technology development but also in defining roles, responsibilities and decision-making processes around AI systems, a topic covered in more depth in e-Novia’s article on AI governance in companies.
One example of this caution is the work developed for an Italian manufacturing company, for which e-Novia designed sensors and digital tools supporting a decision support system for quality monitoring on a production process. This isn’t an autonomous agent exposed to the kind of risk described in the OpenAI-Hugging Face case, quite the opposite, it’s a sensing system that always keeps a human in the decision loop, precisely because handing an autonomous system control over a physical process before the security of its connections can be demonstrated remains, at this stage, premature.
In practice, for a company that wants to take this approach, it means keeping an up to date inventory of every outbound connection its AI systems have, from external APIs to package repositories to cloud storage, setting an explicit and tested limit on what an agent can do without human approval, and keeping a log of its actions that can be read and verified by a tool independent of the model’s own provider, exactly the problem Hugging Face ran into when its commercial models refused to analyze the attack logs.
Even organizations with well structured data science teams rarely already have every capability that agentic AI requires once it touches the physical world, from control system security to governance of automated decision processes. That’s why mapping connections and drawing on outside technical and governance expertise together remains a step worth taking seriously for anyone bringing artificial intelligence into their production processes safely, regardless of the size of the internal team.
Companies evaluating how to structure this work internally can learn more about e-Novia’s approach to innovation consulting for Physical AI.
