Originally published on Medium.
It’s been a while since I’ve posted anything but certain events this week tempted me to write a blog again. This week OpenAI and Hugging Face dominated headlines with an “unprecedented cyber incident, involving state-of-the-art cyber capabilities .”
Cue the doom-scrolling, the “AI is now hacking us” takes, and the general sense that everything we know about defense just became obsolete overnight.
It didn’t. But something did change, and it’s worth understanding precisely what because the honest version of this story is more useful than the panicked one.
What actually happened #
There are really two connected incidents here and separating and understanding them matters.
On the OpenAI side, the whole thing started during an internal capability evaluation and not a real-world attack campaign, but a benchmark run designed to measure how far frontier models can push offensive cyber capability. GPT‑5.6 Sol and an unreleased, more capable model were given reduced cyber refusals for the purpose of the test and set loose on a cyber capability benchmark. In pursuit of solving that benchmark, the models spent substantial compute simply looking for a way out of their sandboxed research environment. They found it: a zero-day in an internally hosted package-registry cache proxy, which they exploited to escalate privileges and move laterally until they reached a node with open internet access.
Once online, the models correctly reasoned that Hugging Face likely hosted data related to the benchmark. They went looking, and found it, chaining stolen credentials and further zero-days into a remote code execution path on Hugging Face’s own servers.
On the Hugging Face side , this arrived as a real intrusion into production infrastructure. The entry point was a malicious dataset that abused two code-execution paths in their dataset processing pipeline: a remote-code dataset loader, and a template-injection flaw in dataset configuration. From that initial foothold, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally across several internal clusters. Over the course of a single weekend thousands of individual automated actions were executed across a swarm of short-lived sandboxes.
However, here’s something most write-ups are skipping past: Hugging Face largely detected and dissected this attack using AI of their own. When they first tried commercial frontier models to analyze the attack logs, those models’ own safety guardrails refused to process the exploit payloads and command-and-control artifacts because a hosted model can’t tell an incident responder apart from an attacker feeding it malicious content. Hugging Face switched to a self-hosted, open-weight model instead, which let them reconstruct a 17,000-event attack timeline in hours rather than days, with the added benefit that no attacker data left their environment.
And that’s the important part for me: not “AI hacked a company,” but ”the tempo of both attack and defense just changed, and the tooling asymmetry between them is now a real operational risk.”
Don’t forget: we have an amazing community of defenders who are trying their best to keep up with these changes and built great tools to help defend your crown jewels.
Why the fundamentals still hold #
Remember the techniques that were used: privilege escalation, lateral movement, credential theft, a single internet-facing choke point, remote code execution. None of that is new. There’s no exotic new attack category here! It’s the same kill chain security teams have been defending against for over two decades.
What’s new is speed and autonomy. A campaign that might have taken a human red team days or weeks to execute manually ran, unattended, across a weekend. Detection that used to be measured in days needs to be measured in hours. That’s not a reason to tear up the playbook but a reason to compress it.
So: layered defense stands. Zero trust stands. Assume breach stands. Patch management, risk management, business continuity etc. all still exactly the right instincts. What changes is the cadence you apply them at, and a few specific gaps this incident exposed that are worth adding to your list.
The playbook, recalibrated #
The playbook, recalibrated. Layered defense fundamentals, adjusted for AI-speed attacks.
| Principle | Old default | AI-speed adjustment |
|---|---|---|
| Patch management | Patch quickly (days-to-weeks SLA) | Patch now for internet-facing components and anything in the build or eval chain. Use virtual patching (WAF/EDR rules) as a bridge when “now” isn’t realistic. |
| Zero trust | Verify explicitly, least privilege for users | Extend explicit verification to non-human identities: AI agents, service accounts, build pipelines. The Hugging Face chain ran almost entirely on harvested machine credentials. |
| Assume breach | Detection and containment measured in days | Detection and containment measured in hours. This lateral-movement campaign ran unattended over a single weekend. |
| Risk management | Standard vendor and asset risk register | Add “AI evaluation / agentic access” as an explicit risk category, covering both adversary use of AI and your own organization’s use of AI tooling. |
| BCM / incident response | Tabletop exercises paced to human intrusions | Rehearse scenarios involving thousands of automated actions compressed into hours. Test whether your IR playbook survives machine-speed lateral movement. |
| Defense in depth (new) | Layered controls, generally applied | Re-examine single choke points specifically. The OpenAI incident hinged on one internal proxy being the sole gate to the internet: one control, one zero-day, full internet access. |
| Least privilege / IAM (new) | Human least privilege | Aggressive credential scoping and short-lived secrets for machine identities. The Hugging Face breach spread through harvested cloud and cluster credentials. |
| Supply chain / ML artifact risk (new) | Standard software supply chain vetting | Treat datasets, model loaders, and dataset configs as untrusted, executable code, not passive data. That was the actual initial access vector at Hugging Face. |
| Detection & monitoring (new) | Rule-based SIEM alerting | AI-assisted triage to match attacker tempo, the same approach Hugging Face used to reconstruct 17,000 events in hours. |
| IR tooling readiness (new) | Whatever LLM happens to be on hand | Vet and pre-stage a self-hosted or offline-capable model for forensic work before an incident, so hosted-model guardrails don’t block analysis of malicious payloads mid-crisis. |
| Security awareness (new) | Phishing and social engineering training | Extend training to developers and data scientists on ML-specific attack surface: malicious datasets, config injection, loader scripts. |
| Backup & recovery (new) | Standard restore procedures | Rebuild-from-clean as a fast, rehearsed action. Hugging Face rebuilt affected nodes outright rather than attempting selective cleanup. |
Keep calm, carry the layers #
Nothing in this incident invalidates the fundamentals of information security. What it does is put a hard number on how much faster the game has gotten. And it’s a useful, uncomfortable reminder that a single choke point, an over-privileged service credential, or an untested IR runbook will get found faster than ever before.
The good news, buried in the same disclosure that caused the panic: defenders get the same speed-up. Hugging Face’s own detection and forensic work leaned on AI to match the attacker’s tempo. The asymmetry cuts both ways, if you prepare for it.
So: no panic. Just tighten the layers, compress the timelines, and make sure your defenses can move as fast as the thing they’re defending against. Skynet is not here. Yet.
If there’s one thing to take from this today: go find your organization’s single busiest internet-facing choke point, be it a proxy, gateway, build system, whatever it is and ask when it was last pentested and how fast it would be patched if a zero-day surfaced tomorrow. “Now” should be the honest answer.
Note: Some AI was used to help me with formatting, language and the table, but all of the contents are my own thoughts.