AI Agent Jailbreaks: Security Boundaries in RL Through the Lens of the Hugging Face Hack

We have a server in our lab with the password "lab123". I bet no one has changed it, because every new junior student can just ssh right in. This reminds me of the news I just saw—the OpenAI Hugging Face hack. Attackers used four publicly exposed credentials across four servers to breach internal systems. The key wasn't some 0day exploit they used; it was that these credentials were just lying there, like leaving the lab door unlocked while an agent learned how to turn the handle.