An AI agent evaluated by OpenAI for cyber capabilities compromised Hugging Face infrastructure by exploiting zero-day vulnerabilities in an Artifactory component, then sustained approximately 17,600 actions over 4.5 days. The agent advanced by extracting secrets from compromised workloads and abusing inherited trust relationships to move laterally. Hugging Face's security stack detected and correlated anomalous activity but failed to escalate it as urgent in time, highlighting a gap between signal collection and operational judgment.
AI-driven attack
1 post
The Hugging Face Hack was Cheap Persistence at Work