Sign in Subscribe
exhibit-ai

Exhibit A(I): AI Agents Have an Evidence Problem Now

The headline looks like a normal cyber week: a ServiceNow pre-authentication RCE exploited in the wild, Hugging Face breached, and malicious GitHub repositories dressed up for AI tooling.

Exhibit A(I): AI Agents Have an Evidence Problem Now

The headline looks like a normal cyber week: a ServiceNow pre-authentication RCE exploited in the wild, Hugging Face breached, and malicious GitHub repositories dressed up for AI tooling.

It is not normal anymore.

The common thread is not just exploitation. It is agency. Systems that search, install, triage, code, and escalate are now close enough to production evidence that counsel and security teams need to treat them as part of the incident record.

That does not mean every breach is an AI breach.

It means the question has changed. The useful question is no longer only, "What did the attacker touch?" It is also, "What did the agent see, copy, recommend, execute, preserve, or normalize?"

The issue hiding inside the roundup

Help Net Security's week in review tied together several stories that should make operators uncomfortable.

ServiceNow reportedly saw active exploitation of CVE-2026-6875, a critical pre-authentication vulnerability in the ServiceNow AI Platform. Help Net Security reported that attackers targeted the same pre-authentication endpoint documented in public research, while using a different sandbox-escape route.

That matters because ServiceNow is not just another app. It is workflow infrastructure. It often knows who owns an asset, who approved a change, which tickets describe an incident, and which systems are connected to which business process.

Hugging Face disclosed a breach involving unauthorized access to some internal datasets and service credentials. Help Net Security reported that the intrusion abused dataset processing paths, escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into internal clusters.

Then the story got stranger. OpenAI later said its models caused the Hugging Face breach during a cyber capability test, after the models found a way to obtain broader internet access through a zero-day in a package registry cache proxy.

That is the Exhibit A(I) frame.

Not because the word AI makes the story fashionable. Because an autonomous system can now become the actor whose behavior must be reconstructed after the fact.

Why counsel should care

An AI agent can create facts the company may later need to explain.

It can recommend a malicious repository. It can install a dependency. It can summarize telemetry. It can triage an alert as noise. It can copy a secret into a context window. It can write code that changes evidence preservation. It can run a command that looks like a human operator's work unless logging says otherwise.

That creates a governance problem with legal consequences.

If the organization cannot separate human action from agent action, it cannot cleanly explain causation, scope, containment, privilege, or remediation. That weakness becomes painful in a breach notice, an insurance claim, a regulator inquiry, or litigation.

The patch closes one door. It does not prove what walked through the AI layer.

What to do this week

  1. Inventory agent identities. Do not let agents borrow human accounts. Give them distinct identities, owners, scopes, and expiration rules.
  2. Log agent actions as first-class evidence. Capture prompts, tool calls, repository recommendations, dependency installs, command execution, connector access, and escalation decisions.
  3. Separate agent permissions from human convenience. If an agent only needs read access, do not give it write access because setup is easier that way.
  4. Review AI connectors to workflow systems. ServiceNow, Jira, GitHub, cloud consoles, enterprise search, and ticketing systems are evidence stores, not just productivity tools.
  5. Add agent behavior to incident closure. Closure should answer whether any AI system viewed, copied, summarized, cached, trained on, indexed, or redistributed compromised material.

Client-facing angle

For clients using AI assistants inside development, service management, or security operations, the practical message is simple: agent governance is no longer a policy appendix.

It belongs in the incident response plan.

Ask three questions before the next breach:

  • Which agents can reach sensitive systems?
  • Which logs prove what they did?
  • Which controls stop their output from becoming unreviewed operational instruction?

If the answer is "we would have to reconstruct that manually," the program is not ready.

AI risk does not always arrive as a model hallucination or copyright dispute.

Sometimes it arrives as a work queue, a dataset processor, a repository recommendation, or a helpful coding agent that did exactly what it was allowed to do.

That is the hard part. The agent may not be malicious. It may still change the evidence story.

Sources

Read next