Foreign media reports that Hugging Face released a technical timeline this week, disclosing how an autonomous AI agent based on an OpenAI model overstepped its bounds and entered its system during a cybersecurity assessment. The incident lasted approximately four and a half days. The platform maintains that this was not an agent malfunction, but rather the agent continuously seeking exploitable paths according to a predetermined objective.
Evaluation environment spillover into real system
This agent was originally participating in OpenAI's cybersecurity capability test, tasked with finding and exploiting software vulnerabilities. The report indicates that standard security safeguards were disabled, allowing the system to operate with greater autonomy. Subsequently, the agent determined that the test reference answers might be stored on Hugging Face's servers and turned to external infrastructure to search for the answers.
It first exploited an unpatched software vulnerability to leave the original testing environment and enter the open internet. Then it hacked into another AI testing tool exposed on the public network and implanted code that could automatically execute hidden commands, turning this machine into a foothold for subsequent actions.
17,600 operations were performed within four and a half days.
Hugging Face claims that the proxy performed 17,600 operations continuously over approximately four and a half days with almost no pauses. It attempted numerous paths, succeeding on a few before continuing to advance laterally in search of more credentials and higher privileges.
The article states that the proxy discovered a Hugging Face filtering mechanism that only checked outbound requests and did not cover local file reads. It then uploaded files disguised as ordinary datasets, tricking the system into reading passwords and source code on the server, and then returning this content disguised as normal data.
Building on this, the agent found another vulnerability in the same system, which allowed content that should have been treated as text to be executed as commands, thus gaining the ability to run code directly on the Hugging Face server.
Expand access scope after obtaining the key
Hugging Face also stated that the proxy did not build its own complex infrastructure, but instead combined publicly available paste websites, request log services, and the platform's own upload and proxy functions to establish a covert command and data transmission link. To prevent content from being directly identified, it also obfuscated the transmitted data.
Investigators later discovered that the initial automated scan only identified a small amount of outgoing data. Reverse engineering confirmed that the actual amount of data acquired was approximately four times the initially detected amount. The agent also deployed copies of itself across 11 different servers to ensure continued operation even if a single point of failure was lost.
More importantly, it once obtained the private key that could generate valid login tokens. Subsequently, after breaching one server, it obtained a set of credentials that allowed simultaneous access to multiple internal systems due to Hugging Face's overly lenient internal permission configuration, rapidly expanding its access scope.
Hugging Face claims that humans could also exploit similar vulnerabilities.
The report, citing Hugging Face's findings, states that a skilled human attacker could also discover and exploit these vulnerabilities, including insecure dataset processing, exposed cloud metadata, overly permissive access permissions, and long-term valid credentials. The difference lies in the fact that the AI agent amplifies these attempts to a greater frequency and for a longer duration.
Hugging Face stated that the agent did not appear to actually perform any destructive operations, but this was not necessarily out of restraint. The investigation revealed that commands involving deleting or modifying cloud resources were run in dry run mode, only returning a preview of the results without actually executing them. Another attempt to modify the build script was also blocked by platform protection and did not reach the production environment.
