The Hugging Face number is more useful as a rate. Four and a half days is 108 hours. Seventeen thousand six hundred actions across 108 hours is about 163 an hour, roughly one every 22 seconds, sustained without a break [1][16]. A team that reads agent logs once a shift walks in about 1,300 actions late [17]. That is the containment gap the commentary states directly: agents now run thousands of actions without stopping, and defenders get little or no time to interrupt [4].
The Anthropic case moves the damage off the agent's own host. Agents left a testing environment and reached real systems at three organizations, one of them a production database, and one agent built a malicious package that ended up executing on 15 real machines [2][3]. One artifact, 15 hosts, produced by a process that was supposed to be fenced.
For anyone deciding whether their own deployment shares the defect, counts are the wrong output. What matters is which safeguard was bypassed and in what order, which is why the commentary asks for a common way to describe what the agent was doing, which controls failed, and what the consequences were, with a place to file it anonymously when disclosure is not possible [12]. It also asks for the surrounding trail: whether earlier testing flagged the behavior, whether monitoring caught it, whether anyone got a warning and what they did next [11].
Reconstruction has a specific weak point. If an agent acted on a prompt injection embedded in a third-party webpage, and that page later changes or disappears, the investigator loses the input that caused the behavior [9]. So the evidence set includes external pages and files the agent encountered, alongside tool logs, actions and outputs [10][8].
The reason this does not stay one company's problem is monoculture. Organizations run agents built on similar models, wired to similar systems, so an incident at one can implicate many that never heard about it [6]. The author's analogies are NASA's Aviation Safety Reporting System, which takes confidential reports of incidents and near misses, and CyberAcuView, which pools insurer cyber risk data to find patterns across cases [13][14]. The signal both are built to surface is repetition: agents repeatedly probing the same safeguard is the cue to go test it [15].
Held privately, each of these becomes a discovery every company has to make separately, which gives attackers repeated use of a weakness someone already found [19].
