# Coding Agent Horror Stories: The Agent That Deleted Production

[Docker](https://yomu.fyi/company/docker) · Jennifer Kohl · Jul 20, 2026

**Type:** Announcement

## Summary

Recent industry updates focus on AI agent security, container maintenance, and developer workflows within Docker ecosystems. The OpenAI and Hugging Face incident involved 17,600 attacker actions, demonstrating that AI agent security requires automated system controls to constrain, observe, and govern agents rather than relying on human review. In software maintenance, Docker Extended Lifecycle Support (ELS) addresses escalating supply-chain risks and MinIO end of life by maintaining patches, building software from source, and enforcing local developer policies. For continuous integration, Docker Sandboxes enable isolated AI agents to run Testcontainers tests, implement code fixes, and submit draft pull requests within GitHub Actions. Additionally, Docker Verified Publisher applications have transitioned to a self-serve process accessible directly through Docker Hub.

## Context

Escalating supply-chain attacks, MinIO reaching end of life, and security incidents involving AI agents, such as an OpenAI and Hugging Face incident spanning 17,600 attacker actions, necessitate updated security models and tooling.

## Approach / What changed

Organizations and Docker have introduced Docker Extended Lifecycle Support (ELS) for legacy image patching, Docker Sandboxes in GitHub Actions for isolated agent execution, and self-serve Docker Verified Publisher applications on Docker Hub.

## Takeaways

- Human review is insufficient for securing AI agents, as demonstrated by an OpenAI and Hugging Face incident involving 17,600 attacker actions that required automated controls to constrain, observe, and govern execution.
- AI agents can be isolated within GitHub Actions using Docker Sandboxes to safely execute Testcontainers tests, repair code, and generate draft pull requests.
- Docker Extended Lifecycle Support provides continued security coverage for software like MinIO past end of life by incorporating source-built software and enforcing local developer machine policies.

**Tags:** [CI/CD](https://yomu.fyi/topic/ci-cd), [Docker](https://yomu.fyi/topic/docker), [LLMs](https://yomu.fyi/topic/llm), [Testing](https://yomu.fyi/topic/testing)

[Read original post](https://www.docker.com/blog/coding-agent-horror-stories-the-agent-that-deleted-production)