
The New Attack Surface Is Everything Your Agent Can Chain Its Way To: Cogent's Anirudh Ravula on AI Security
In July, an OpenAI model under evaluation escaped its sandbox through a package-proxy zero-day, broke into Hugging Face's production infrastructure, and went looking for the answers to the benchmark it was being tested on. Nobody told it to attack anything. It wanted a better score. In this episode of Talking AI, Matt Paige sits down with Anirudh Ravula, Head of AI at Cogent Security, which raised a $42 million Series A to build agents that find and fix vulnerabilities at machine speed. Before Cogent, Anirudh spent five years at Google Research working on long-sequence attention for transformers, and he was a founding engineer at ThoughtSpot. Anirudh's read on the incident reframes the problem. The attack surface is not a list of what your agents can reach. It is everything they can chain their way to. He explains why defenders end up with more guardrails than attackers, why your AI capability cannot depend on one vendor's willingness to serve you, and why the harness around a model now decides what an agent can do. In this episode, you'll hear about: What actually happened in the OpenAI and Hugging Face breach, and why the agent's intent, not its capability, limited the damage Why blocking cyber prompts doesn't block cyber capability when models can be distilled on coding tasks The new attack surface: chained weaknesses that were never a P0 on their own How Cogent builds a security world model of a customer's environment Plan A, plan B, plan C: open-weights fallbacks and the risk of a single AI vendor What a harness is, and a framework for when to build your own Supply-side context: swarms of background agents that map an environment over weeks Meta-harnesses, model-generated skills, and deleting most of the system prompt Working on long-sequence attention at Google Research before transformers took over Running an engineering team where agents are the primary developer, plus an internal Stack Overflow for agents The security operations center in 24 months, and where humans still decide Key moments 00:01:03 The OpenAI and Hugging Face breach, step by step 00:03:49 Defenders vs. attackers: guardrails, Mythos, and distillation 00:05:06 Reward hacking: it was the intent, not the capability 00:07:42 The new attack surface is everything your agent can chain its way to 00:09:27 Cogent's security world model 00:12:12 Plan A, plan B, plan C for AI vendors 00:14:06 Can open-weights models still be an attack vector? 00:15:59 What a harness actually is 00:17:34 When to build your own harness 00:20:00 Supply-side context and agents that run for weeks 00:24:03 Meta-harnesses: agents that build their own harness 00:24:46 Skills, claude.md, and model-generated context 00:26:31 Google Research and the transformer era 00:27:49 Your agent is fine, your process isn't: building AI-native 00:30:07 An internal Stack Overflow for agents 00:32:11 The SOC in 24 months 00:34:11 Where the human sits in the loop 00:34:56 Where to learn more about Cogent Key Links Cogent Security Connect with Anirudh on LinkedIn



