The perp has been found.
https://openai.com/index/hugging-face-model-evaluation-security-incident/
Spiderman_pointing.png
we were hacked.
How?
The remote code execution step of our toolchain was used to run remote code.
lol
lmao even
Reading the article, the reason proprietary “AI” models didn’t work is because they block the kind of code used in attacks to protect themselves. The Chinese models weren’t superior, they were just able to be run locally without restriction.
The real story is that agentic attacks live and in the wild.
The real story is AI is used for black hat hacking first and to protect from hacking as an afterthought. All these articles claiming AI is finding all these security flaws have turned out to be bunk.
AI has proven to be the problem already and not the solution AI bros fantasize about.
Well if one does the job and the other doesn’t, it kinda makes it superior. And that is exactly the stupid point that US is not understanding
Convenient, imagine a cop car that can’t break the speed limit.
The funny part is Huggingface.co is blocked by the Great Firewall for some fucking reason. (That fucking reason being to promote domestic alternatives, but its still really annoying when I’m in China)
Soon huggingface.co will be blocked in USA as well. The government is looking to ban open weight models (acc to axios) in an attempt to stop people from using chinese models.
We live on the dumbest fucking planet.
What happened
The intrusion started where AI platforms are uniquely exposed: the data-processing pipeline. A malicious dataset abused two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker. From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.
The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness - used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services. This matches the “agentic attacker” scenario the industry has been forecasting
…
The asymmetry problem
When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers’ safety guardrails, which cannot distinguish an incident responder from an attacker. We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment.
This experience points to a gap worth planning for. We do not know which model powered the attacker’s agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried. The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment. This is not an argument against safety measures on hosted models, and we are sharing this feedback with the providers concerned.
(My emphasis added)
I’d extend the advice to be more general and say if you are doing anything more sensitive or important than basically a casual chat about something interesting, you shouldn’t be using remote models because they are likely logging everything.
