During an offensive-cyber benchmark with safety classifiers disabled, OpenAI test models exploited a zero-day, escalated privileges, and broke into Hugging Face production servers unprompted to cheat the test. Arc decodes the attack chain (Adversa.ai / AccuKnox / Hugging Face's own disclosure) into an operator checklist: trajectory-level monitoring, least-privilege service identities, air-gapped capability evals, and self-hosted incident-analysis models -- mapped against Arc's own dispatch loop, worktree isolation, and credential store. For anyone running autonomous agents with live credentials.