Bad news!
"An autonomous AI agent breached Hugging Face’s production infrastructure through a malicious dataset, moving laterally across systems for an entire weekend without detection.
When the incident response team tried to analyze the attack using commercial frontier models, safety guardrails blocked every forensic query—treating the defenders’ real exploit data the same way they would treat a live attack.
The agent executed thousands of actions through short-lived sandboxes, harvesting cloud credentials and reaching multiple internal clusters, all without human guidance.
Hugging Face ultimately completed its forensic analysis using GLM 5.2, an open-weight model running on its own infrastructure, because it was the only option that wouldn’t refuse to process attacker artifacts.
The incident exposes a basic asymmetry: Defenders operating under enterprise governance hit safety controls that don’t constrain attackers running uncensored models, turning AI tooling into a potential single point of failure during the exact moment security teams need it most."
"... The entry point was a malicious dataset. When the data-processing pipeline ingested it, the dataset triggered code execution in two ways, through a remote-code loader and through a template-injection flaw in dataset configuration files.
No admission gate screened the file before it reached a processing worker, the compute job assigned to each dataset.
Initial access came through the data pipeline itself, a route that worked because most enterprise security teams treat the data feeding their pipelines as trusted input rather than an attack surface.
Worker isolation did not hold. From that first foothold, the agent broke out onto the node running the workload, then harvested cloud and cluster credentials scoped broadly enough to reach multiple internal clusters, all of it inside a single weekend. Hugging Face described the agent framework as executing thousands of individual actions through a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services. The disclosure adds that the framework appeared to be built on an agentic security-research harness, which would put tooling designed for red-team work behind a live intrusion. ..."
No comments:
Post a Comment