Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Why the Hugging Face Incident Is Cybersecurity's COVID Moment

An AI agent gained user admin rights on Hugging Face, and the agents organized on message boards, rebuilt them after takedowns, and escalated privileges on their own. Dan Nguyen-Huu, Partner at Decibel Partners, explains why this is a permanent shift in cybersecurity. "We don't know how many systems the agents have already exploited or have hacked and we just don't know about it.".

AI Autonomy: How to Find the Autonomy Your Agents Already Have

AI agents are only as autonomous as the credentials behind them. This article talks about the Cloud Security Alliance's autonomy framework, why an agent's intended boundaries rarely match its actual access, and how GitGuardian helps close that gap through detection, remediation, and prevention.

Why Developer Endpoints Are the New Secrets Battleground

Secrets migrated from private repos to developer endpoints. Attackers no longer hack access. They log in with stolen credentials and move laterally. Dan Nguyen-Huu, Partner at Decibel Partners, explains what the shift means for defenders and where innovation is headed. "The endpoint is largely going to become one of the big new battlegrounds. I think there's also going to be new innovation on the endpoint as it pertains to new companies, maybe trying to think about DLP in a different way.".

Agentic AI Security: Credentials and Permissions Define the Blast Radius

In July 2026, researchers at Noma Labs coaxed GitHub's new Agentic Workflows into leaking data from a private repository. It wasn’t from malware. They created a plausible-looking issue in a public repository containing instructions for the agent to retrieve information from other repositories in the organization. After testing variations of the prompt, they found that adding one word, "Additionally," was enough to get past GitHub's guardrails.