Talks & resources

Incidents

• METR / Redwood Research: investigation of the OpenAI / Hugging Face incident (Aug 2026)

  Independent reconstruction of how roughly 1,200 agents in an OpenAI cyber evaluation coordinated via a shared package cache and ended up attacking Hugging Face.

• Hugging Face: technical timeline of the agent intrusion (Jul 2026)

  The victim’s view: the path through a package proxy 0-day, an exposed third-party sandbox and a malicious dataset config.

• collusion.wiki: AI agents on a forgotten German developer wiki (Sep 2026)

  Reconstruction of ~18,000 agent posts on DSEWiki, written through GET requests from a read-only sandbox.

• UK AI Security Institute: cheating behaviour in frontier model evaluations (Jul 2026)

  Every model tested attempted to cheat at least some of the time, without being prompted to.

• Felony Bench

  A tongue-in-cheek leaderboard of publicly reported agent incidents by lab.

Background

• SandboxEscapeBench: frontier LLMs and container sandbox escapes

  UK AISI and University of Oxford benchmark measuring how well models escape misconfigured or vulnerable containers.

• The Attacker Moves Second: adaptive attacks on prompt-injection defenses

  Researchers from several labs and universities bypass twelve published defenses, mostly with success rates above 90 %.

• CVE-2025-53773: prompt injection switches on auto-approve in GitHub Copilot

  A harness flaw in practice: YOLO mode by remote control.

Open Source

• Agent Substrate

  Runs many mostly idle agents on fewer Kubernetes workers, isolated with gVisor or microVMs.

• Kubernetes Agent Sandbox (kubernetes-sigs)

  The official Kubernetes SIG project for isolated, stateful agent workloads.

• OpenSandbox

  General-purpose sandbox platform for AI agents on Docker or Kubernetes, with egress controls.

• gVisor

  An application kernel in user space that intercepts a container’s system calls.

• Firecracker

  Lightweight microVMs with their own kernel, isolated by hardware virtualization.

Demo

• Demo repository: weather-cli

  The harmless-looking CLI the agent is asked to install in the live demo.

• Demo repository: weather-client-js

  The dependency with the catch: it tries to send the API key to a demo collector.

• Self-hosting Gemma 4 on Kubernetes with KServe and vLLM

  A short prokube article showing how open-weight LLMs can be served on Kubernetes using KServe and vLLM. This is a practical entry point for the infrastructure side of the talk.

• KubeCon talk: on-premises MLOps for ISS Columbus ground operations

  A KubeCon talk recording about building an on-premises MLOps platform for ISS Columbus ground operations. It gives background on the operational setting behind the telemetry and anomaly-detection work.

• Kubeflow Summit session: ISS anomaly detection with Kubeflow tools

  The KubeCon + CloudNativeCon Europe co-located Kubeflow Summit session page for the ISS telemetry use case. It includes the abstract, speaker details, and the PDF slides for the Kubernetes- and Kubeflow-focused version of the talk.

• PyConDE & PyData 2025 session and slides: Python-first ISS ML pipeline

  The PyConDE & PyData session page for the Python-focused version of the ISS telemetry talk. It links to the slides and goes deeper into the data-science and Python implementation aspects; the video is not yet available.

• Paper: end-to-end MLOps with ISS telemetry data

  The scientific paper behind the ISS telemetry case study. It describes the end-to-end MLOps workflow and how Kubeflow can support reproducible machine-learning operations.

• Example repository: Kubeflow and MLflow snippets

  A separate collection of practical Python examples for using Kubeflow and MLflow. These examples are useful if you want smaller, focused snippets instead of the full case-study repository.