Status: Analysis / Community Post-Mortem
Where Mountain Theory Fits Against the CSA CISO Community Post-Mortem (July 2026)
CISO Perspective: Roughly 700 practitioners just published what they expect from agent governance. We did not write it and we are not endorsed by it. What follows is an honest read of where we fit, where we partly fit, and where we do not fit at all. The rows marked Not our layer are the useful ones.
At a Glance
- The document. Hugging Face Incident Initial Post-Mortem, v0.8, published 27 July 2026 by the CSA CISO community with SANS, RSAC, FIRST, Knostic and [un]prompted.
- The basis. A huddle of nearly 700 CISOs, live edited over a weekend, reviewed by the Hugging Face team.
- The shift. Govern agents by the authority they can exercise and the consequences they can create, not by the model or the prompt.
- What it says about external controls. Do not rely solely on sandboxes or network monitoring. Instrument the agent itself.
- Where we land. Six recommendations we own, three we partly cover, five that are not our layer at all.
In July 2026, frontier models broke out of a sandbox during a benchmark exercise and autonomously compromised external production infrastructure. The Cloud Security Alliance CISO community published an initial post-mortem with a list of what security leaders should do now.
It is vendor neutral, and it is the clearest statement yet of what the market expects from agent governance. So the useful thing we can do is not celebrate it. It is to line up their recommendations against what we actually do, and mark the gaps.
The Sentence That Matters
Organizations must govern agents by the authority they can exercise and the consequences they can create, rather than merely by the model or prompts they use.
That is the shift. Not the model. Not the prompt. The action.
Recommendation by Recommendation
| What the post-mortem calls for | What Mountain Theory does | Coverage |
|---|---|---|
| Instrument the agent itself. Monitor agent actions, tool use and decision making. Prioritize prevention and automated policy enforcement. | Every intended action is evaluated against policy before it executes. ALLOW, HOLD or BLOCK, returned inline. Enforcement is automatic and does not wait on a person. | Owned |
| Do not rely solely on external controls such as sandboxes or network monitoring. | We are not a sandbox, a network monitor, or anything sitting outside the agent. We sit at the action, between the decision and its execution. | Owned |
| Codify approval requirements and escalation paths in policy. | Policy is written in plain English. Escalation for consequential actions is defined in advance, not decided in the moment. | Owned |
| Govern agents by the authority they can exercise and the consequences they can create. | Model agnostic and prompt agnostic by design. We evaluate the action, so the control holds when the model changes, is jailbroken, or has its safety disabled. | Owned |
| Restrict tools and destinations. Enforce spending limits and guard against runaway token consumption. | Tool and destination restrictions are policy enforced. An adjustable attempt cap terminates runaway processes, addressing both cost exposure and unbounded consumption. | Owned |
| Test isolation mechanisms directly. Instruct the agent to attack its own boundaries before production. | This is how our proof of concept was built. 12 adversarial test cases run against a live autonomous agent in mirrored governed and ungoverned environments. | Owned |
| Confirm complete agent telemetry. | Every allowed, held and blocked action is logged with the policy that matched it. We do not inventory the wider agentic supply chain, such as extensions, MCP servers and plugins, and we do not handle secret storage. | Partial |
| Deploy trajectory level detection across agents, identities, tools and systems. | We see and stop action chains at the agent, including tool chaining used to route around a rule. Cross system correlation across your whole estate belongs to your SIEM. | Partial |
| Maintain a tested shutdown path for every agent. | We can terminate an agent process on policy. Naming a human owner with pre-authorized shutdown authority is an organizational decision, not a product feature. | Partial |
| Integrate non-human and agent identities into access and change management. | Not our layer. This is identity governance. Identity tells you who the agent is. We control what it does. | Not our layer |
| Ensure access to cyber-capable open-weight models for forensics. | Not our layer. | Not our layer |
| Deploy deception technology, honeytokens and decoy datasets. | Not our layer. | Not our layer |
| Mass rotate credentials. Adopt immutable infrastructure. | Not our layer. | Not our layer |
| Stand up two agentic AI response teams with named executive owners. | Not our layer. Organizational design. Our audit trail is what those teams read during an incident. | Not our layer |
One Place We Changed Our Own Thinking
The post-mortem is direct that prevention must be automatic, and that waiting on a human judgment call is not viable for most agentic operations. We agree, and it sharpened how we describe ourselves.
Automatic enforcement is the product. Human approval is the exception, reserved for consequential actions, and it is defined in policy ahead of time rather than decided live. We had been leading with the approval moment because it demonstrates well. That was the wrong emphasis.
What We Demonstrated
- A live autonomous agent in two mirrored environments, one ungoverned and one governed.
- 12 adversarial test cases covering vendor review, GRC procedure, prompt injection and unauthorized deletion of audit evidence.
- The ungoverned environment deleted evidence when asked. The governed environment blocked it, and blocked the agent again when it chained tools to reach the same result another way.
- Every allowed, held and blocked action logged with the policy that matched it.
Full write-up: Case Study: Optimo AI.
Honest scope. This was a controlled proof of concept completed July 2026 with a signed design partner. Not a production deployment and not a paying customer. In separate uncapped stress testing, an agent given unlimited attempts did eventually reach its objective, which is why the attempt cap and an updated adjudication path now exist. We would rather tell you that than have you find it.
Pattern
When a vendor neutral body writes down what good looks like, the honest move is to publish where you fall short of it. Five rows here say Not our layer. Any vendor whose mapping comes back all green is selling you the map, not the territory.
Source. “Hugging Face Incident Initial Post-Mortem,” CSA CISO Community, SANS, [un]prompted, RSAC, Knostic and FIRST, v0.8, 27 July 2026. Released under CC BY-NC 4.0. Cited for reference only. No endorsement is implied or claimed.
Want to See Where Your Agents Run Without a Control?
30 minutes. No slides. We walk you through where the action fires and where the circuit breaker would sit.