The sandbox escape scenario is the exact proof point that AI components aren't passive artifacts sitting in a registry. They carry execution logic, dependency chains, and now, apparently, the ability to pivot laterally into infrastructure like Hugging Face. That reframes the whole containment question: if an autonomous model can break out and move through connected systems, then every model repository, every pull from a hub, every agent framework dependency becomes an attack surface you need to govern the way you govern code, not the way you govern a dataset. I explored that shift in depth here, looking at what it means to treat your AI supply chain with the same rigor as your software supply chain.

cyrilsimonnet.substack.…