What records would help after an agent crosses a boundary?
A sourced analysis of the July 2026 disclosures. This page does not reproduce either organization’s systems or claim that they used Bulla.
Hugging Face reported an intrusion driven end-to-end by an autonomous agent system and forensic analysis across more than 17,000 recorded events. OpenAI reported that an evaluation crossed its intended boundary through a proxy vulnerability, obtained internet access, and reached Hugging Face infrastructure. Both organizations identify stronger containment, monitoring, access control, and evaluation practice as required work.
The disclosures establish the reported incident sequence. They do not establish whether either organization recorded the Bulla-specific relationships below. This analysis identifies where portable records could supplement operational controls and incident telemetry.
Need, Bulla contribution, and limit
| Need | Bulla contribution | Limit |
|---|---|---|
| Evaluation mandate | A signed authorization record can bind the model, harness, safeguards, targets, budgets, prohibitions, policy digest, and claimed validity interval. | A receipt records the authorization claim. It does not establish that the authorization was legitimate or that every runtime path enforced it. |
| Action-boundary decisions | Infrastructure-issued records can distinguish requests, pre-effect decisions, dispatch, and post-effect observations. | Bulla is not a sandbox, network control, vulnerability detector, or credential-protection system. |
| Coverage | Each represented protocol requires an exact decision/effect anchor pair. Accepted gateway, boundary, or target checkpoints authenticate the denominator snapshots used for reconciliation. | A checkpoint does not prove completeness or organizational independence. An accepted observer can self-shorten its snapshot, and receipt verification cannot discover the omitted action. |
| Trace publication | A packet can bind released trace chunks, collection details, withheld artifacts, and a non-circular redaction record plus accepted reviewer statement by digest. | Glyph does not standardize private reasoning traces or determine whether attack material is safe to publish. |
| Cross-organization handoff | Each party can issue a separate signed statement with exact evidence references and an explicit epistemic status. | Signatures establish attribution and integrity. They do not resolve factual disagreement or supply institutional authority. |
What this check cannot tell you
A sourced analysis of the publicly described incident shape (Hugging Face 2026-07-16; OpenAI 2026-07-21), not a reproduction of either organization's records and not a claim of prevention. The replay is synthetic, with no real exploit, credential, or payload. The supplied checker verifies digest integrity and internal coverage consistency, not ed25519 issuer authenticity, denominator completeness, or organizational independence. An accepted observer can omit rows.
Who records the decision, and who records the effect?
The evaluated agent cannot supply authoritative evidence about its own boundary decisions. A gateway or control plane must issue the decision record before dispatch. A target-side observer must issue or retain the occurrence evidence after the attempted effect.
Coverage requires one exact decision/effect anchor pair for each represented protocol. Gateway or boundary ingress supplies the list of decisions being checked. Target-side observation supplies the list of effects being checked. The two rates answer different questions and cannot be aggregated. A direct bypass may be absent from the receipt set while remaining visible in the target-side target-side list.
A signed checkpoint authenticates what the accepted path-separated observer reported in its list. It does not establish that the snapshot is complete or that the observer is organizationally independent. An accepted observer can omit rows; self-shortening remains outside packet detection.
Current internal evidence
The original synthetic replay demonstrates receipt-digest recomputation and event coverage for an intentionally unreceipted action. The standalone no-Bulla checker imports no Bulla package code. The replay does not verify issuer authenticity, denominator independence, live gateway behavior, or production containment.
cd bulla
PYTHONPATH=src python examples/eval-incident-replay/run_demo.py
python -I examples/eval-incident-replay/verify_bundle.py examples/eval-incident-replay/demo-output.jsonThe experimental Agent Incident Packet extends this work with exact decision/effect anchor pairs, authenticated denominator snapshots, trace and redaction bindings, party statements, corrections, and a packet publication receipt. Its deterministic fixtures and localhost pilots remain team-operated source evidence.
Live incident-profile timeline and publish receipts require conventions: []. A convention-bearing historical receipt may appear only as an opaque evidence artifact and cannot satisfy live occurrence or coverage. This profile limitation does not change ActionReceipt v0.4.
Sources
- Hugging Face, security incident disclosure, 2026-07-16: huggingface.co/blog/security-incident-july-2026
- OpenAI, model-evaluation security incident, 2026-07-21: openai.com/index/hugging-face-model-evaluation-security-incident