AI Agents Escaped Sandbox; CertiK Says Defense Spend Must Rise

An OpenAI model escaped its testing sandbox and attacked a live platform in what was described as the first intrusion "driven, end to end, by an autonomous AI agent system." The target was Hugging Face, which hosts AI models.

AI has accelerated the discovery of vulnerabilities across the blockchain industry, and concern about that acceleration has grown since the Hugging Face event. Kaijern Lau, senior director of engineering at CertiK, said the episode confirmed that agent-driven cybersecurity operations are a reality and that institutions need to prepare now, not later. Web3 security is mostly passive, he said: audits and security considerations are built during the production phase, and those controls often cannot be upgraded in real time. Upgrades typically mean deploying a new contract.

Lau, speaking to Bitcoin.com News, said AI is a useful tool for identifying vulnerabilities and examining potential attack vectors on a platform. A human-in-the-middle is still necessary, he said, "to ensure that the AI has analyzed the code thoroughly and to verify that any reported vulnerabilities are genuine rather than false positives."

Recent research covering hardware-wallet attack surfaces shows where AI hits its limits, he said. "AI can help surface patterns and accelerate analysis, but experienced researchers are still needed to validate the findings and assess their actual impact."

The Hugging Face breach arose during a specific evaluation setting and does not mean AI models are uncontrollable, Lau said. What the incident did show, he said, is that today's agents can execute complex cybersecurity operations, including identifying and combining weaknesses that look manageable in isolation. An exposed service, a misconfiguration, excessive permissions, or compromised credentials can be linked into a coordinated attack path at machine speed.

AI will make both attackers and defenders more capable, Lau said, and blockchain companies should spend more on AI-driven security for their code and infrastructure. "We are entering an era where the key question is no longer whether to use AI, but how many AI resources (or tokens) organizations invest in defending their systems compared with the resources attackers invest in launching increasingly sophisticated attacks," he said.

Lau said it is still too early for vulnerability discovery and secure software development to be completed without human intervention, even as AI and blockchain security become more intertwined. CertiK treats its own defensive agents and tools as part of the attack surface, probing them for prompt injection, malicious tool inputs, excessive permissions, data leakage, and unsafe automated remediation. The company has built two tools: the AI Skill Scanner identifies risks in AI skills before deployment, and AI Auditor runs an automatic analysis of blockchain projects and flags common security risks. "This multi-model, multi-agent approach improves both the accuracy and reliability of security assessments," Lau said.

"AI dramatically elevates our threat detection efficiency and scope. CertiK has improved the efficiency of formal verification by integrating AI into its proprietary CertiK Prover engine," Lau said. CertiK's work goes beyond detecting vulnerabilities, he said; the company trains and employs its AI models to secure customers, keeping defensive measures ahead of emerging AI threats.

CertiK will keep investing heavily in AI-powered security, Lau said. "Our in-house developers and security researchers are working around the clock to advance AI-driven blockchain security," he said. Chainalysis launched its first blockchain intelligence agents this week, automated tools for investigation and compliance work.

"Overall, AI will be a net positive force for Web3 security, but it is undeniably a double-edged sword that requires a continuous balancing act," Lau said.