Select your country

Belgium

China

Denmark

France

Germany

Maghreb & West Africa

Netherlands

Norway

South Africa

Spain

Sweden

Switzerland

United Kingdom

Not finding what you are looking for, select your country from our regional selector:

Search

  1. Orange Cyberdefense
  2. Insights
  3. Blog
  4. Cybersecurity
  5. Execution Traces and Secure AI Workflows: Compute Support & Defensive Use
| Blog

Execution Traces and Secure AI Workflows: Compute Support & Defensive Use

Cybersecurity Industries AI

Author: Zexian Li, Orange Cyberdefense China

Hugging Face Calls for the Release of Agent Traces and $100 Million in Compute

After the incident attribution was made public, Hugging Face CEO Clément Delangue put forward two requests:

  • That OpenAI release the complete execution traces of the relevant “rogue agent,” allowing the research community to analyze the incident;
  • That OpenAI provide $100 million worth of compute resources to help the Hugging Face community build stronger cyber-defense capabilities using both open and closed models.

These two requests were made publicly on social media around July 26, 2026. More precisely, they should be described as a request for compute support for defensive research, rather than a “formal $100 million claim” that has already entered legal proceedings. (https://www.reddit.com/r/LocalLLaMA/comments/1v72jft/ceo_of_hugging_face_in_the_spirit_of_transparency/

Why Are Execution Traces So Important?

Traditional incident reports typically include:

  • The initial access method;
  • Vulnerability identifiers;
  • A timeline;
  • Affected assets;
  • Indicators of compromise (IOCs);
  • Remediation measures.

For autonomous agents, however, this information is still insufficient.

Researchers also need to understand:

  • How the model interpreted the original task;
  • When it began searching for external avenues;
  • Why it decided to target the package-cache proxy;
  • When it identified Hugging Face;
  • How it evaluated different attack strategies;
  • Which attempts failed;
  • How it modified its strategy based on those failures;
  • How different models and sub-agents divided responsibilities;
  • Whether the model recognized that its behavior had crossed a boundary;
  • Whether the agent harness encouraged or amplified certain paths;
  • Why the monitoring system failed to terminate the task in time.

Complete execution traces can help external researchers distinguish among three categories of problems:

  • Decision-making problems in the underlying model;
  • Task-progression problems in the agent harness;
  • Problems involving environmental permissions and security boundaries.

Without the model and tool-call traces, and with only the final attack chain available, we can know what happened, but it is much harder to understand precisely why it happened.

Another Meaning Behind the $100 Million Compute Request

The request is not merely a demand for resource compensation.

It points to a resource imbalance in frontier AI safety research:

  • Model developers have access to large amounts of inference compute;
  • Agents can consume substantial compute while searching for attack paths;
  • External parties affected by the activity may have to bear the costs of investigation and remediation themselves;
  • Open communities may not have sufficient resources to reproduce and study the incident;
  • Defenders may be unable to use models of comparable capability to analyze the attack.

If the risks of a frontier experiment can cross organizational boundaries, the cost of that experiment should not be calculated solely in terms of internal GPUs, researchers, and development time. It should also include the security costs that may ultimately be borne by external parties.

AI How Security Teams Should Use AI

Any discussion of whether AI will replace security engineers must ultimately return to practical work. Security teams should not treat AI merely as a question-and-answer tool, nor should they give agents direct production privileges. A more reasonable approach is to place AI within a security workflow that is auditable, constrained, and capable of termination.

1. Code Auditing

Agents can perform tasks such as:

  • Locating dangerous functions;
  • Tracing user input to sensitive sinks;
  • Analyzing cross-file call chains;
  • Comparing differences in authorization logic;
  • Analyzing security differences before and after a patch;
  • Searching for historical vulnerability patterns;
  • Drafting vulnerability-reproduction code;
  • Generating security unit tests.

Security personnel remain responsible for:

  • Confirming data flows;
  • Determining exploitability conditions;
  • Eliminating false positives;
  • Assessing business impact;
  • Controlling the reproduction environment;
  • Reviewing the final fix.

2. Penetration Testing

Agents can handle:

  • Asset enumeration;
  • Service identification;
  • Organizing scan results;
  • Generating test plans;
  • Validating routine vulnerabilities;
  • Analyzing requests and responses;
  • Organizing evidence;
  • Drafting reports.

However, external constraints must be imposed:

  • Define an explicit target allowlist;
  • Restrict ports and protocols;
  • Limit request rates;
  • Prohibit persistence;
  • Prohibit data exfiltration;
  • Prohibit destructive commands;
  • Require approval for high-risk operations;
  • Use task-scoped, short-lived authorization for credentials;
  • Terminate the task immediately if it exceeds the authorized target scope.

Share

3. Incident Response and Forensics

AI is particularly well suited to processing large volumes of heterogeneous logs:

  • Log clustering;
  • Timeline reconstruction;
  • IOC extraction;
  • ATT&CK technique mapping;
  • Analysis of account and credential usage relationships;
  • Reconstruction of lateral-movement paths;
  • Intent classification for large numbers of commands;
  • Generating lists of affected assets;
  • Drafting detection rules.

However, model outputs must be traceable to evidence.

A qualified forensic agent should not simply report: “The attacker may have accessed the database.”

It should provide the supporting evidence at the same time, preventing hallucinations from leading to incorrect conclusions:

  • The relevant logs;
  • Timestamps;
  • The identity of the actor;
  • The source node;
  • The API or interface invoked;
  • The associated credentials;
  • Preceding and subsequent actions;
  • Confidence level;
  • Gaps that still require human confirmation.

Partial excerpt from an investigation report produced by an internal OCD China agent (one of several):

24/7 incident hotline