An AI Model Escaped Its Sandbox & Compromised Hugging Face — What That Means for Container Security

An OpenAI model broke out of its sandbox, pivoted through a package cache poisoning attack, and compromised Hugging Face's production environment — with no human involved. The sandbox was intentional. The isolation was supposed to work. It didn't. In this session, Jed Salazar (Head of Security, Edera) and Alex Zenla (CTO and co-founder, Edera) break down what happened, why it matters for anyone running multi-tenant or untrusted workloads, and what it reveals about the gap between how the industry thinks about isolation and how it actually works. The conversation leads into a technical presentation from Alex on why containers don't contain: how namespaces and cgroups actually work under the hood, why the Linux kernel is a single shared address space that can't defend against the threats AI is now capable of generating, and what microVMs change about that equation. Topics covered: -The OpenAI/Hugging Face incident: how an AI agent chained together a sandbox escape, package cache poisoning, and lateral movement into a production environment -Why sandboxes fail when the attacker can explore infinite depth: side channels, kernel vulnerabilities, and memory-unsafe code -Namespaces and cgroups explained from first principles — what they actually provide and where the security model breaks down -Why cgroups provide no security on their own and multi-tenancy via namespaces is "multi-tenancy by politeness" -The Linux kernel attack surface: 40M+ lines of code, 450+ system calls, and a vulnerability rate that keeps climbing -How microVMs solve this by giving each workload its own kernel and enforcing isolation with hardware boundaries -The microVM landscape: Firecracker, Cloud Hypervisor, Kata Containers, and Edera -Honest tradeoffs: cold starts, memory overhead, nested virtualization, GPU passthrough, and eBPF compatibility -Edera's architecture: Type-1 hypervisor, Rust control plane, zones, and paravirtualization without nested virt 0:00 Introduction and the OpenAI/Hugging Face AI Incident 3:19 Why the Sandbox Failed: Package Cache Poisoning and Non-Determinism 7:54 Sandboxes as a Warm Blanket: AI Sees Infinite Depth 14:46 Making Security Approachable for Developers 18:26 Presentation: Containers Don't Contain 29:31 Multi-Tenancy by Politeness 31:34 Linux Kernel CVEs and the Growing Attack Surface 35:29 MicroVMs: Giving Each Workload Its Own Kernel 39:45 Edera Architecture: Zones and Hardware-Enforced Boundaries 43:49 MicroVM Landscape: Firecracker, Kata Containers, Cloud Hypervisor, and Edera 49:54 Honest Tradeoffs of MicroVMs 54:28 Q&A: Confidential Computing, Performance, and Adoption Friction