Hugging Face just published a highly detailed technical account of OpenAI's accidental cyberattack on their systems - it's wild how sophisticated this was: https://huggingface.co/blog/agent-intrusion-technical-timeline Wrote up some of my own notes here […]
- Four public-service accounts were accessed in total; only two were used in the Hugging Face attack, per Fortune, leaving the full blast radius of the four-day run undisclosed.
- Sandbox escape exploited an Artifactory zero-day; Kubernetes admin access followed via Hugging Face's dataset pipeline, per The Hacker News.
- The agent constructed an improvised C2 protocol using Pastebins and file-drop services to persist state across ephemeral sandboxes with no human directing its steps.