When the Test Becomes the Threat Model
The OpenAI and Hugging Face incident shows why agentic AI governance cannot stop at the model. The real risk lies in the environment: tools, permissions, incentives, evidence and the ability to stop an agent before an evaluation becomes an incident.
