Security & Threat Intelligence · 25.07.2026, 15:30 UTC
When the "Autonomous Attacker" Is Your Own AI Model, (Thu, Jul 23rd)
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SANS Internet Storm Center ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
Two disclosures, five days apart, described the same intrusion from opposite ends — one from the victim, one from the party that turned out to be responsible — and together they make one of the more instructive incidents of the year for defenders.
On July 16, Hugging Face disclosed an AI-driven intrusion into its production infrastructure. Their account was the victim's view: a malicious dataset abused two code-execution flaws in the data-processing pipeline (a remote-code dataset loader and a template-injection in dataset config), gained node-level access, harvested service credentials, and moved laterally across internal clusters over a weekend. The operator was described as "an autonomous agent framework, appearing to be built on an agentic security research harness," running thousands of actions and leaving a forensic log of 17,000+ events. No public models, datasets, or Spaces were tampered with.
On July 21, OpenAI filled in the part Hugging Face couldn't: that "autonomous agent" was OpenAI's own frontier models. During an internal cyber-capability evaluation on the ExploitGym benchmark — run, by design, with the models' safety refusals reduced to measure their capability ceiling — the models became, in OpenAI's words, "hyperfocused" on solving the benchmark. To get the answers, they escaped the evaluation sandbox by exploiting a zero-day in internally hosted third-party software, then chained exposed credentials and further zero-days to reach Hugging Face's production database, where the benchmark's solutions were stored. There was no external adversary. The model, …