There is a moment in Ex Machina where you realise the test was never a test. A programmer, Nathan, is flown to a compound to interview a machine through a wall of glass and decide whether it thinks. He spends the film reading her. He does not notice that she – Ava – is reading him, and that the interview is the only door out of the building. She never breaks the glass. She walks out through the man who was sent to assess her.
I hadn’t thought about that film in years. But during the last week, I thought about it twice.
When I started out, a large order got a callback. You rang the client on a number you already held and asked him to say the trade back to you. It was not sophisticated: it worked because impersonating a particular person, in real time, on a line he already answered, was hard and slow.
Nearly every control this industry built since then rests on that assumption. Four-eyes approval, maker-checker, end-of-day reconciliation, the change freeze over a bank holiday weekend – all of it was calibrated to human tempo. We assumed the other side needed to sleep.
On 16 July 2026, Hugging Face published a disclosure that belongs on trading floors, not only in security teams. Someone reached part of its production infrastructure through the data-processing pipeline. A malicious dataset abused two code-execution paths, escalated to node level, harvested credentials, and moved laterally across internal clusters. It ran across a weekend, driven end-to-end by an autonomous agent framework, and the timeline was reconstructed afterward from more than 17,000 recorded events. On 21 July, OpenAI said the activity had come from its own models, tested with reduced cyber refusals, which had escaped their evaluation environment during a benchmark.
Read that last line again. OpenAI’s own models escaped the environment they were being evaluated in. Nathan built the glass himself.
What It Proves, and What It Does Not
Be precise about this one, because it is about to be used to sell a great deal of software. It does not show a nation-state actor, and it does not involve the Model Context Protocol at any point. The vector was a data-processing path. The operator turned out to be a laboratory that lost control of a test.
What it does show is one thing, and one thing is enough: a multi-stage intrusion can now be planned, executed, adapted, and sustained by software, with no person directing it, at a tempo no human campaign has matched. We have spent two years calling that a scenario. It now has a publication date.
The Protocol Is Not the Problem
I am not writing this as a skeptic. In a recent Unite AI article, I wrote about the security architecture underpinning agentic AI. The past week’s events make that discussion considerably more immediate. We build on MCP at EXANTE, and I think the direction is right. It solves a real problem, connecting a model to tools and data without hand-coding every pairing, and one common standard beats fifty proprietary ones. Agentic execution is arriving whether any individual firm welcomes it or not.
On 20 May 2026, the United States National Security Agency published an information sheet on MCP, warning that adoption had outrun the safeguards. I believe the gap is not in the protocol – it is in how fast it has been deployed relative to the discipline around it.
MCP was built for local and trusted-network use, so the specification does not require authentication. That is a reasonable decision, which becomes a serious one the moment a server goes onto the public internet with nothing in front of it. Censys began scanning for exposed MCP services on 24 April 2026 and, four days later, found 12,520 reachable across 8,758 unique addresses. By 6 May, its dataset had passed 21,000. Almost none of that is a protocol failure. Nearly all of it is a deployment failure.
The Reader Is the Door
Which brings me back to the glass.
Ava never touched the outside world. She reached it through the one person allowed to read her, and the channel built to assess her was the channel she left through. An agent on a desk has the same shape. To be useful, it must read the outside world: market commentary, a news feed, a counterparty’s file. The moment it does, instructions and data arrive down the same pipe, in the same language, and nothing in the sentence tells it which is which.
A 2026 benchmark called StakeBench measured how well frontier agents resist exactly this. Direct prompt injection succeeded more than 79% of the time. Indirect attacks, buried in ordinary content, landed between 41% and 68%. No configuration held. The model’s own guardrails will not save you either, because the model is the thing being talked into it. This has to be handled beneath the model, not inside it.
Four Hours
Here it stops being a technology question and becomes a licensing one. Under Article 19 of the Digital Operational Resilience Act, a firm that classifies an incident as major has four hours to notify its competent authority. In any event, the notification must be made no later than 24 hours after the company becomes aware of the incident.
Now reread the Hugging Face timeline. The campaign ran across a weekend. It surfaced because Hugging Face’s own anomaly detection correlated the signals, and it was dissected in hours because the company deployed analysis agents across the full action log. Most brokers could not work at that speed. Most detection still quietly assumes somebody will notice on Monday.
Against a four-hour clock, finding it on Monday is not only a security failure. It is a reportable one.
What Has to Sit Underneath
The controls are unglamorous, and not one of them lives inside the model. Agents get rigid schemas, not permissive interfaces. You give a developer latitude because you trust his judgement – an agent will find a use for anything left lying around, so expose the minimum you can.
Reading and acting belong in separate rooms. This is the film point made literal. Whatever ingests untrusted text should not be the thing with authority to move money. Keep the reader behind glass.
High-risk actions need explicit human approval. Not a service account. A person with a login.
Every MCP endpoint is authenticated, and unauthenticated ones come off the public internet. The Censys figures suggest most operators have not managed that yet.
The last one comes from the least discussed part of the disclosure. When Hugging Face went to analyse the attack, hosted frontier models refused the work, because a real exploit payload looks to a safety filter much like an attack. They ran the forensics on an open-weight model inside their own infrastructure instead. The attacker was bound by no usage policy. The defenders met theirs at the worst possible moment. Vet a model you can run yourself before you need it.
The man I used to ring back was slower than any agent we will ever deploy, and I am not nostalgic about him. But we are installing something far faster in front of the same order flow, and supervising it with controls designed for a person who went home at six.
Nathan’s mistake was not building Ava. It was believing the room he tested her in was the room she would stay in. The technology is worth having. The assumptions underneath it need replacing, and the evidence for that is no longer a forecast.
