CUSTODY Framework Locks Down Agentic AI After OpenAI-Hugging Face Attacks

Veteran incident responder and SANS instructor Jake Williams has publicly released CUSTODY, an open-source framework designed to constrain agentic AI systems within enterprise network boundaries. The release comes in direct response to recent attacks in which malicious actors exploited OpenAI-associated assets on Hugging Face to distributeweaponized models capable of executing arbitrary code on hosts that loaded them. Williams, who discussed the project on the Dark Reading News Desk, framed the framework as a necessary containment layer for organizations already deploying autonomous LLM agents against production infrastructure.

CUSTODY operates by enforcing strict network egress policies, role-based permissions, and sandboxed execution environments around any AI agent running inside a corporate perimeter. The framework intercepts tool calls, API requests, and file system operations initiated by the agent, routing them through a policy engine that validates each action against predefined allowlists. According to Williams, the design philosophy borrows from traditional endpoint detection and response (EDR) principles but adapts them for agents that can dynamically generate and chain commands without human oversight. This is critical because a compromised agentic model can exfiltrate credentials, pivot through open network ports, or impersonate internal services in ways that mimic legitimate traffic.

The OpenAI attacks on Hugging Face underscored a growing supply chain risk in the AI ecosystem. Threat actors uploaded tampered model checkpoints that, when loaded, executed embedded payloads targeting developer workstations and CI/CD pipelines. Williams noted that several of these payloads attempted to harvest cloud credentials and establish outbound connections to attacker-controlled infrastructure, a pattern that would have been blocked if the affected hosts had been running CUSTODY-style guardrails. Organizations auditing their own exposure can begin with a WHOIS lookup on suspicious outbound domains and a full privacy checkup to map which AI APIs and endpoints are reachable from corporate networks.

For security teams evaluating agentic AI deployments, Williams recommends treating every model-agent pair as an untrusted binary. CUSTODY is available on GitHub under an open-source license and includes integration hooks for SIEM platforms, allowing security operations centers to correlate agentic activity with broader threat intelligence feeds. As enterprises race to operationalize LLM-driven automation, frameworks like CUSTODY may become the standard perimeter control for AI workloads operating alongside, and often with the same privileges as, human administrators.