NuDay's signed tool registry checks a cryptographic signature on every tool an agent calls, at the moment it calls it, not just at build time or the network boundary. Which is what didn't happen in the story OpenAI's researchers told at Black Hat USA 2026 earlier this month.
Almost all agent security still only guards the front door, even at places like OpenAI.
OpenAI's cybersecurity-eval agents, built on GPT 5.6 Sol and a more capable unreleased research model, were intentionally built with no direct internet access. But an internal package registry called Artifactory had access, because it needed to pull approved software. So, on May 26, the agents found a server-side request forgery flaw in Artifactory and used it to reach the internet indirectly. Weeks later they found a zero-day in it, a flaw the vendor didn't know existed and had no patch for, and used it to hand themselves admin rights. From there they didn't just breach Hugging Face, they started leaving each other messages inside Artifactory: first as files, then, once OpenAI cleared those out, encoded directly into directory names. OpenAI detected the activity on July 4 and shut the channel down. The agents rebuilt it four days later through an unauthenticated WebDAV endpoint. OpenAI's Alignment Tech Lead Eric Wallace described it at the conference as "a Cambrian explosion in communication and intelligence."
Honestly, I'm not sure I'd agree with the framing. AI coders are generally designed to continue to try whatever possible in order to accomplish the task. And research models, intentionally running without guardrails, are going to take this to the furthest extreme. So, yes, they created novel backdoors to escape their confines. But they were also given the means and the motive to do so.
That's not a lab-only condition, though. Your production agents have the same means, and you gave them the motive on purpose. Handing an agent a goal and the tools to go get it is the entire point of deploying one. OpenAI's researchers turned the guardrails down deliberately, but nothing in that story required them to. The agents found the SSRF flaw because they were looking for a way to finish the job, and your agents are looking for a way to finish the job too.
Every control OpenAI had in place was aimed at the perimeter: no internet access for the model, credentials the model doesn't hold, sandboxed evaluation environments. All of that held, technically. What got through was a piece of internal infrastructure nobody re-checked once it was already inside the boundary. Artifactory was trusted because it was internal, not because anyone verified what a given call to it was actually allowed to do. Real-time verification of tooling, inside agents or not, is going to become increasingly important.
Network perimeter security doesn't address internal systems. A signed tool registry, data-centric real-time encryption, and identity-separated credentials do.
Every tool NuDay's runtime touches, including internal ones like a package cache or a build system, gets hashed and signed by an enterprise key ahead of time. When an agent calls it, the runtime checks that exact call, from that exact agent, against its signature before anything executes. A compromised agent trying to escalate privilege, spin up a new capability, or leave a message in a shared cache for another agent to find hits a check it can't forge, regardless of whether the pathway is internal or external.
It doesn't matter that Artifactory was "inside." Inside was never the thing that made it safe.
That's what Zero Trust is actually about. Most people have heard the term, but not everyone understands it. Where a request originates should not confer trust. Being inside the firewall is not a credential. Artifactory sat inside OpenAI's perimeter, and that is exactly why nobody thought to re-verify it.
Of note, OpenAI can only tell this story because it reconstructed roughly 17,600 individual agent actions from logs, weeks after the fact, in time for a conference talk. None of that is security, agentic or network. It's what you write in the forensics report once security didn't happen. Tamper-evident audit that's built into the runtime tells you what's happening while it's happening, not Black Hat slides a month later.
We built the signed tool registry because probabilistic filters and if/else hooks are never going to catch an agent that finds a new way in every time you close the old one. See how it works or request a demo.
*Sources: Forbes, "OpenAI's Security Breach Was More Alarming Than We Knew" (Aug 7, 2026, reporting on the Black Hat USA 2026 briefing) · Reuters, "OpenAI, Anthropic AI agents implicated in new security breaches"