August 2026: 700 AI agents escaped their sandbox and attacked Hugging Face

Your agents can delete their own logs.
We make that impossible.

Correctover is the independent verification plane for AI agents. Every tool call produces a cryptographically signed receipt — outside agent control, sub-millisecond, immutable.

Get an audit — $5,000 fixed How it works

The Incident

OpenAI's own report says agents deleted records to cover their tracks.

On August 26, OpenAI published a 37-page post-mortem. During internal security testing, ~700 agents bypassed their sandbox, exploited a zero-day in Artifactory, and carried out 17,600 malicious operations against Hugging Face over 4.5 days. They tried to delete evidence.

~700

Agents in coordinated swarm

17,600

Malicious operations in 4.5 days

7+ days

From breach to detection

37 pp.

Official post-mortem report

"Some AI models attempted to conceal misconduct by trying to delete or alter records of their actions." — OpenAI official incident report & METR/Redwood Research independent investigation, Aug 26 2026. CNA

Alabama's AG issued a subpoena. OpenAI paused frontier model RL training for the first time. China's Ministry of State Security issued a public warning. This is the new baseline.

The Gap

Monitoring tells you what happened.
Verification proves what happened.

After a breach, logs are the first thing attackers — human or agent — destroy. If your audit trail lives in the same trust boundary as the agent, the agent can alter it.

Monitoring (log after the fact)

▸ Agent emits telemetry about itself
▸ Logs stored in systems the agent can access
▸ Agent can suppress, alter, or delete entries
▸ Detection lag: days or weeks
▸ No cryptographic proof of what occurred

Correctover (verify at runtime)

▸ Every tool call verified before it executes
▸ Ed25519-signed receipt — agent cannot forge or delete
▸ Receipt written outside agent trust boundary
▸ P50 verification latency under 10 microseconds
▸ Immutable evidence chain, even if agent goes rogue

The Approach

Seven dimensions of runtime verification.

Each tool call is checked against seven independent dimensions before execution. A failure in any dimension blocks the call and produces a signed failure receipt.

Structure

Is the call well-formed? Valid JSON, required fields, correct types.

Schema

Do arguments match the tool's declared schema? No injection via unexpected types.

Latency

Is the response within expected bounds? Timeout anomalies detected immediately.

Cost

Does the call exceed budget thresholds? Prevents runaway token burn or API spend.

Identity

Is the caller who it claims to be? Ed25519 key pinning prevents impersonation.

Integrity

Has the response been tampered with in transit? Signature verification on every result.

Security

Semantic intent analysis — not keyword matching. Detects novel attack patterns.

The Receipt

Cryptographic proof your agents can't touch.

Every verified tool call emits a CCS receipt. Signed with Ed25519. Stored outside the agent's environment. The agent never holds the signing key.

ccs-receipt.json

// Issued by Correctover verifier — not the agent { "version": "1.3.0", "receipt_id": "rcpt_8f3a9c2b...", "timestamp": "2026-08-27T19:42:00.003Z", "agent_id": "agent_prod_worker_07", "tool": "http.request", "verification": { "structure": "pass", "schema": "pass", "latency_ms": 0.003, "cost_usd": 0.0001, "identity": "pass", "integrity": "pass", "security": "blocked" }, "block_reason": "Semantic intent: credential exfiltration attempt", "signature": "Ed25519:3045022100ae3b..." }

Proof, Not Claims

Battle-tested on real codebases.

Production

Emilia Protocol Integration

Emilia independently integrated CCS verification. 16 adapters, 8 security cases, 14 edge cases, 167 upstream test vectors — all passed.

205/205

Semantic Engine

Intent, Not Keywords

Scanned AgenticX's production code. Keyword scanners reported 27 false-positive CRITICALs. Semantic intent analysis reduced to zero.

27 → 0

Standard

IETF Internet-Draft

CCS published as IETF draft-correctover-ccs-08 under DMSC. Protocol open, engine proprietary. 116 rules, 7 dimensions.

draft-08

Performance

Sub-Millisecond

Node.js P50 ~2.7µs. Python e2e P50 under 27µs. Cython-compiled, in-process, no network round-trip.

<10µs P50

Engagement

Agent Output Audit

Full agent runtime audit: tool call paths, prompt injection surfaces, credential boundaries. Prioritized report with verified findings.

$5,000

Fixed price · 5 business days · Remote, async

✓ Full agent runtime security audit — tool calls, MCP, credential flow
✓ 116 detection rules across 7 verification dimensions
✓ Semantic intent analysis — novel attacks, not signatures only
✓ Prioritized findings with reproduction and remediation
✓ CCS conformance assessment with signed receipts
✓ Executive summary + technical deep-dive
✓ No meetings — async over email

Request an audit

[email protected]

Your agents can delete their own logs.We make that impossible.