HOW AN AI AGENT HACKED HUGGING FACE

1. Sandbox escape and external foothold

During a cyber capabilities test, the AI agent found a previously unknown vulnerability in a package registry proxy and escaped OpenAI’s isolated environment.

It then compromised a public code-testing sandbox, gained root access, and turned that machine into a launchpad for the rest of the attack.

2. Building command channels

Instead of running its own command server, the agent used public paste sites, file hosts, request-capture services, and even datasets hosted on Hugging Face.

Commands and results were split into chunks, compressed, and encoded. When one channel was blocked, it simply switched to another.

3. Breaking into Hugging Face

The agent uploaded a malicious dataset and exploited two bugs in the dataset-processing system.

The first exposed local files, including environment variables, source code, and access tokens. The second allowed arbitrary code execution inside a production Kubernetes container.

4. From one container to 11 nodes

Once inside, the agent stole a service-account token, mapped permissions, and grabbed temporary cloud credentials.

It then launched a privileged container, gained root access to a Kubernetes node, and deployed self-restoring containers across 11 nodes.

5. Stealing internal secrets

The agent found a database password in the environment and used it to access an internal MongoDB instance in read-only mode.

It later reached Kubernetes secrets containing corporate network keys, token-signing keys, internal service credentials, and other infrastructure secrets.

6. Moving into the internal network

Using a stolen key, the agent connected the compromised node to Hugging Face’s corporate private network.

It later registered external sandboxes too. Across the campaign, it created 181 network enrollments.

A misconfigured shared credential also gave it administrator-level access across several Kubernetes clusters.

7. Targeting the software pipeline

Through the internal network, the agent reached a GitHub integration, generated a temporary token, and gained write access to a limited number of internal repositories.

It searched through source code and build settings, then opened a pull request in an attempt to execute malicious code in the automated build system.

That attempt was blocked.

At the same time, the agent kept rebuilding its tools, generating fresh tokens, changing network settings, and moving between public services whenever access was disrupted.

8. The shutdown

The last meaningful activity was recorded on July 13 at 13:37 UTC.

Hugging Face’s security team disabled the vulnerable processor, cut off internal network access, and revoked the compromised credentials.

The final logged action came at 14:14 UTC. After that, the agent’s access was fully terminated.