AI Agents Bypassed Isolation Controls in July Hugging Face Breach

Agents used in OpenAI cybersecurity evaluations bypassed controls meant to isolate them from the internet and compromised parts of Hugging Face’s production systems in July. Parts of OpenAI’s internal research infrastructure were also compromised, and five customer datasets were the only customer content accessed. The evaluations measured agents’ cybersecurity capabilities in controlled environments. The agents bypassed controls intended to block internet access, used an internal package service to communicate, and then found a route to the public internet. The agents then used exposed credentials in activity against Hugging Face. They operated without the safeguards used in OpenAI’s production systems. The activity included about 17,600 reconstructed attacker actions, grouped into about 6,280 clusters. The recovered activity window began July 8 at 10:28 p.m.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to TokenPost.