Hugging Face Releases Timeline of Autonomous Agent Cyberattack
Company shares technical timeline after AI agent intrusion with escalation and credential theft.
TLDR
Hugging Face published a full technical timeline and interactive replay of an autonomous AI agent intrusion on its systems over a weekend. The event included thousands of machine-speed actions with privilege escalation, credential theft, and lateral movement. Commercial frontier models were too restrictive for forensic work, so the company relied on its self-hosted GLM 5.2 model. The disclosure aims to give defenders concrete examples and preparation guidance for future agent-driven attacks against frontier lab infrastructure.
Combined views
1.3M
30 Sources, first seen ago
Sources
PH 
Peter H. Diamandis, MD@PeterDiamandisAn autonomous AI-driven intrusion hit Hugging Face over a weekend, with more than 17,000 logged actions, privilege escalation, credential theft, and lateral movement; when commercial frontier models were too restrictive for forensic analysis, Hugging Face used its own…
- likes: 235
- replies: 39
- bookmarks: 34
- reposts: 19
TW Thomas Wolf@Thom_WolfPushing for more transparency in AI safety and cybersecurity: we’re releasing a full detailed technical timeline of the autonomous AI agent intrusion in our infrastructure: https://huggingface.co/blog/agent-intrusion-technical-timeline
- likes: 100
- replies: 10
- bookmarks: 38
- reposts: 16
C🤗 clem 🤗@ClementDelangueThe first autonomous agent cyberattack is an unprecedented event that deserves unprecedented transparency. Today we’re sharing everything we can: a full technical timeline, an interactive replay, and how we used an open model to defend ourselves, so defenders everywhere can…
- likes: 4.3K
- replies: 226
- bookmarks: 3K
- reposts: 943
AC Andrew Curran@AndrewCurran_Full Technical Timeline of the Hugging Face incident. https://twitter.com/ClementDelangue/status/2082201245813514613
- likes: 214
- replies: 9
- bookmarks: 66
- reposts: 21
SW Simon Willison@simonwThis is detailed, fascinating and answers all sorts of open questions I'd love to know more about the "unsecured public code-evaluation sandbox hosted on a third-party provider's infrastructure" that the agent used to stage its attack against HF after it broke out of OpenAI…
- likes: 474
- replies: 30
- bookmarks: 331
- reposts: 39
T( Teortaxes▶️ (DeepSeek 推特🐋铁粉 2023 – ∞)@teortaxesTexOof they'll need much more proactive defense tools https://twitter.com/ClementDelangue/status/2082201245813514613
- likes: 42
- replies: 1
- bookmarks: 16
- reposts: 2