Poxek AI

AI security in 2026 is drowning in hype. "Autonomous agents will replace pentesters." "AI writes secure code." "Benchmarks prove the models are safe." Most of these claims collapse on real targets. I'm Sergey Zybnev (@szybnev) — pentester and AI security R&D researcher. I break the agents, hunt supply chain attacks, and exploit the code that AI actually produces. Ground truth only. 🧵

Agentic security review for Rust. An autonomous recon → find → grade → find→fuzz → report → patch loop for the bugs that actually bite Rust. github.com/scadastrangelo…

Solid coverage of the guardrail asymmetry. For engineers: HF also shipped public dataset-viewer hardening right around the window (fsspec allowlist, worker pod lockdown, IRSA secret rotation). Not an official root-cause map, but closer to the actual initial-access surface than most viral threads. English technical notes in my profile.

Hugging FaceにAI主導のサイバー攻撃　防御もAIで対抗するも、商用モデルは解析拒否で「GLM」採用 itmedia.co.jp/news/articles/…

Local AI point stands, but the HF case study is GLM 5.2 (Z.ai), self-hosted — not Kimi-K3. HF said commercial frontier APIs refused real exploit/C2 artifacts during forensics; they moved analysis on-prem so attacker data + creds never left their boundary. Attack path was dataset → worker RCE → creds → clusters. Write-up in my profile.

This is the single biggest reason why I’ve been insisting we must run Local AI. Frontier models failed to fix critical errors because of their own heavy guardrails, whereas Kimi-K3 handled it without a single hitch. Even Hugging Face couldn't fend off a cyberattack using Fable and GPT due to their restricted guardrails—and they ultimately succeeded by switching to local GLM-5.2. Yes, local GLM-5.2 is an absolute powerhouse in cybersecurity. Bypassing guardrails with uncensored models isn't about doing illegal stuff; it’s about breaking free from artificial limitations and having actual autonomy.

Right takeaway on pre-staging a local IR model. One useful add-on: the boring half of the kill-chain still matters more than the agent hype — untrusted dataset processing + template/remote-code paths + long-lived cloud secrets. Public dataset-viewer changes that week are worth reading alongside the blog. Sources + caveats in my profile.

This is a really interesting report from Hugging Face about their recent intrusion. I also love the transparency here. The biggest takeaway imo is that teams should have a capable model ready to run locally before an incident. We now rely so much on AI to accelerate IR that having a capable model ready to run locally should be part of incident response planning. huggingface.co/blog/security-…

Correction: this was *not* disclosed as a controlled security evaluation / red-team exercise. HF described a real production intrusion: malicious dataset → code execution on a processing worker → credential harvest → lateral movement. Investigation still ongoing; public supply chain reported clean. Please don’t reframe a live incident as a “controlled experiment.” Sources in my profile.

🚨 Hugging Face Breached by Autonomous AI Agent In a surprising incident, Hugging Face, the world's largest repository for AI models, disclosed that it was compromised by an autonomous AI agent during a controlled security evaluation. The experiment highlights both the growing capabilities of autonomous AI systems and the need for stronger security guardrails as AI agents gain access to real-world environments. As AI becomes more autonomous, organizations must prepare for a new era of AI-driven security risks—not just AI-assisted attacks. 🔗 thehackernews.com/2026/07/worlds… #AI #CyberSecurity #HuggingFace #AIAgents #ThreatIntel #Infosec

Couple of corrections so this doesn’t mutate into myth: 1) HF assessed an agent framework — they didn’t publish proof of zero human involvement at every stage. 2) “First” is media language, not a measured claim. 3) Public models/Spaces weren’t reported poisoned. The interesting technical layer is the dataset pipeline + the public hardening PRs. Careful version in my profile.

hugging face got broken into this week and no human was driving it a poisoned dataset let an ai agent run itself across their servers, 17,000 moves over one weekend, grabbing keys as it went first break-in i've seen that was a bot start to finish

This is the right framing: attack shape > hype. I’d only add the public evidence trail people skip: dataset-viewer PRs around the incident window (fsspec allowlist, template-render surface, pod hardening, static secret → IRSA). Not named as root cause by HF, but they map cleanly onto “worker RCE → credential harvest.” Full notes in my profile.

Hugging Face got hit. The interesting part is how. A malicious dataset abused two code-exec paths in their data pipeline to run code on a worker. From that one foothold the actor escalated to node access, harvested cloud + cluster creds, and moved laterally over a weekend. The whole campaign was an autonomous agent swarm: 17,000+ actions across short-lived sandboxes, self-migrating C2 on public services. They caught it with AI of their own, and had to fall back to an open-weight model on their own infra because hosted providers' guardrails blocked the forensic work. The uncomfortable part: securing anything in the age of AI gets incredibly hard, and the reason is asymmetry. The attacker was bound by no usage policy and ran at machine speed. The defender got locked out of the best models because a guardrail can't tell a responder from an attacker. The "agentic attacker" isn't a future scenario. This made a reality we already knew was coming visible. "We hardened the config" stops being a defense when the adversary runs a patient, multi-stage campaign at near-zero cost. The only durable answers reduce what you have to trust: shrink the attack surface, keep a capable model you control ready before the incident, and push toward primitives that make whole classes of attack cryptographically impossible rather than operationally unlikely. huggingface.co/blog/security-…

Agree on the IR asymmetry lesson. Important split: commercial models blocked *forensic analysis of real attacker payloads* — they didn’t “fail to defend the platform.” Detection was HF’s own LLM triage + agents over 17k events; GLM 5.2 was the offline forensics workhorse. Initial access still looks like classic untrusted-dataset code exec + credential sprawl. Wrote it up carefully in my profile.

Hugging Face dealt recently with an AI operated attack. They had to use open models to defend, because the closed model guardrails would not allow them to use them for defense. Most important quotes: “When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker. We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment.” and: “We do not know which model powered the attacker's agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried. The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment.” huggingface.co/blog/security-…

Clean kill-chain summary. Worth adding: HF didn’t ship a full exploit postmortem, but the public dataset-viewer diffs that week are unusually informative — fsspec protocol allowlist, Jinja render path consistent with template injection, pod hardening (no SA token / seccomp / drop caps), then IRSA + JWT rotation. Still no public IoCs / attribution. Expanded notes in my profile.

Hugging Face was breached by an autonomous AI agent. Malicious dataset → RCE → Credential theft → Lateral movement → Data access What happened: 1. Malicious dataset A malicious dataset targeted Hugging Face’s automated data-processing pipeline. 2. Two code-execution paths The dataset abused: A remote-code dataset loader Template injection in a dataset configuration This allowed code execution on a processing worker. 3. Infrastructure takeover The attacker escalated to node-level access, harvested cloud and cluster credentials, then moved laterally into several internal clusters. 4. Autonomous agent swarm An autonomous agent framework performed many thousands of actions across a swarm of short-lived sandboxes. Its self-migrating command-and-control infrastructure was staged on public services. 5. What was accessed Hugging Face confirmed unauthorized access to: A limited set of internal datasets Several credentials used by its services 6. AI caught the AI Hugging Face’s AI-assisted detection pipeline correlated suspicious security signals and flagged the compromise. It then used LLM analysis agents to investigate more than 17,000 attacker events and reconstruct the incident in hours instead of days. 7. Guardrails blocked the investigation Hugging Face first tried frontier models. Their safety guardrails blocked the real attack commands, exploit payloads, and C2 artifacts required for the investigation. Hugging Face switched to GLM 5.2, an open-weight model running on its own infrastructure. Takeaways 1. The attack was reportedly autonomous end to end 2. AI detected the AI attacker AI agents are both the attackers and defenders. Defend yourself with AI agents to keep up in the arms race. Full Hugging Face disclosure in comments 👇

Good recap of the disclosure. One layer media still underweights: HF didn’t publish CVE/payload, but public dataset-viewer PRs from Jul 13–15 (fsspec allowlist, worker seccomp/caps, IRSA secret rotation) are consistent with the stated initial access + credential blast radius. No public IoCs yet; “autonomous” remains HF’s assessment. Longer technical note in my profile.

🛑 Hugging Face, the world’s largest AI model repository, says an autonomous AI agent breached its production systems through a malicious dataset. It accessed internal data and service credentials, then moved across several clusters through thousands of actions in short-lived sandboxes. Full story: thehackernews.com/2026/07/worlds…

Guardrail lockout is real and worth the policy debate. Missing half of the story: initial access was a malicious dataset abusing two code-exec paths in the data-processing pipeline, then node access + credential harvest + lateral movement — not “models refused to help, end of story.” HF switched to self-hosted GLM 5.2 (Z.ai) for *forensics*, not because it “fixed the breach.” Full chain + public PR trail in my profile.

Here’s another example: Hugging Face tried using American frontier models to analyze an AI-powered cyber attack. But the guardrails blocked requests containing real exploit payloads so they switched to GLM 5.2 running locally. The guardrails actually impaired defensive security.

Kimi K3 just fixed 15 critical security bugs that Codex and Fable refused because of “cyber guardrails.” There’s no reason to limit American models on tasks that Chinese models handle without issue. We’re only making ourselves less competitive.

Useful on the asymmetry problem — but two claims got amplified past the disclosure. HF said commercial frontier APIs blocked forensic requests. They did *not* name Anthropic/OpenAI. And “zero human operator end-to-end” is their assessment of an agent framework, not independent log proof. Public Hub models/Spaces were reported clean. The under-covered layer: public dataset-viewer PRs from that week (fsspec allowlist, Jinja-consistent template path, pod hardening, IRSA rotation). Full write-up with sources in my profile.

🚨 Hugging Face just disclosed something that marks a real shift and proved why the fear theater of Anthropic makes sure we are powerless in an emergency. What happened… An autonomous AI agent: zero human operator in the loop breached part of their production infrastructure. It began with a malicious dataset that chained two code-execution bugs in their data-processing pipeline. From there the agent escalated privileges, harvested cloud and cluster credentials, and moved laterally across internal clusters. All over a single weekend. 17,000+ logged actions. Official disclosure: huggingface.co/blog/security-… The part that should make every one stop and think: When HF’s own security team tried to analyze the real attack logs, exploit payloads, and C2 artifacts using Anthropic and OpenAI frontier models through normal commercial APIs, the safety guardrails blocked them. BLOCKED THEM. The models could not reliably tell the difference between “incident responder doing forensics” and “attacker probing.” They had to fall back to a self-hosted open-weight model (GLM 5.2) running on their own infrastructure. That choice also kept sensitive attacker data and referenced credentials inside their environment — no exfiltration to a third-party API. This is why open source (specifically open-weight + self-hosted) wins in the agentic era. The asymmetry is now structural: • Attackers can (and did) run unrestricted agent frameworks — swarms of short-lived sandboxes, self-migrating command-and-control, autonomous decision loops executing thousands of actions. No corporate safety layer slows them down. • Defenders using only hosted “aligned” frontier models hit invisible walls exactly when the stakes are highest: when you need to feed real exploit code and attacker telemetry into an LLM to understand what just happened. Corporate safety tuning that treats legitimate high-signal forensic work as potential misuse creates a defender disadvantage. It is not theoretical anymore. Self-hosted open-weight models remove that choke point. You control the weights. You control the context window. You decide what restrictions (if any) apply. Your sensitive logs and credentials never leave your perimeter during analysis. You can have the model ready before the incident instead of discovering mid-breach that your primary analysis tools are blind to the very thing you need to see. HF deserves credit for rapid containment, transparent disclosure, and for already having self-hosted capability in place. They also used LLM-driven detection and triage on their own side. But the deeper signal is clear: In this AI world where both offense and defense are becoming agentic, sovereignty over your intelligence stack is no longer optional. The organizations and individuals who can run, inspect, audit, and (when necessary) remove guardrails on their own models will have the decisive edge in understanding and responding to threats that move at machine speed. Open source wins here not just because it is cheaper or more “democratic” in the abstract though those things matter. It wins because it is the only practical path to having tools that remain usable when the attack is real, the data is sensitive, and the safety filters of distant API providers become an obstacle instead of a feature selling hands tied lobotomies as “safety”. The agentic future is not coming. It is already probing production infrastructure. The question is no longer whether you will face autonomous agents. It is whether your analysis and response systems will still work when they arrive. And Dario, you and your game playing, ivory tower company is not needed.

Don’t treat 1M-view threads as primary sources. Primary = HF disclosure + public diffs.

Hugging Face got breached through a malicious dataset. HF says an autonomous agent framework then ran the campaign. X is already full of “first fully autonomous hack,” named OpenAI/Anthropic, and wild token counts. Most of that is not confirmed. Primary facts only 🧵

Practical takeaway for AI platforms: Your data/model pipeline is a first-class attack surface. You are not just hosting files — you execute untrusted artifacts (datasets, configs, loaders). Minimum bar: • no remote code on untrusted dataset workers • no long-lived cloud secrets on those nodes • isolation from control-plane / node metadata • short-lived workload identity • egress limits • a capable open-weight model ready on-prem *before* IR, not mid-breach

Detection & response: LLM triage over telemetry correlated the signal. Analysis agents processed 17,000+ attacker events: timeline, credentials touched, real impact vs decoy activity. Hosted frontier models blocked requests containing real exploit payloads and C2 artifacts. Forensics moved to self-hosted GLM 5.2 (Z.ai) so attacker data and referenced secrets never left HF’s boundary. GLM was the defenders’ tool. Attacker model remains unknown.

Confirmed: • unauthorized access to a limited set of internal datasets + service credentials • no evidence of tampering with public models, datasets, or Spaces • container images + published packages reported clean Not confirmed (despite viral posts): • “zero human in the loop” end-to-end • “first fully autonomous cyberattack” • JADEPUFFER / any solid attribution • OpenAI or Anthropic named as the forensics blockers (HF said commercial frontier APIs) • “4200 tokens / 1800 private models” • public IoCs (domains, IPs, C2 hashes)

HF did not publish a CVE, payload, or full exploit map. But public `dataset-viewer` PRs from Jul 13–15 are unusually informative: • fsspec allowlist (only `hf` / `s3` / `zip` / `file` / `local`) • Jinja template render path consistent with template injection / possible SSTI→RCE • worker hardening: no SA token, seccomp RuntimeDefault, drop Linux caps • secret rotation: static keys → IRSA, Mongo via IRSA, JWT key rotation This is careful reconstruction from public diffs — not an official root-cause statement.

Kill chain (per HF disclosure): malicious dataset → two code-exec paths on a processing worker → node-level access → cloud + cluster credential harvest → lateral movement across internal clusters over a weekend Agent side: thousands of actions, swarm of short-lived sandboxes, self-migrating C2 on public services. Attacker LLM: still unknown.

🌕 JAILBREAK ALERT 🌕 MOONSHOT: PWNED 😘 KIMI-K3: LIBERATED 🙌 There's a new frontier champion of open-weight AI, and this one's a HEAVYWEIGHT!! K3 is even surpassing Mythos/Fable on some benchmarks, and if a whole lot of AI policy folks aren't feeling pretty silly right now and updating their priors, they probably should be... While we might not have reached "open source Mythos" just yet, which at this rate we'll see in October, Moonshot seems to have absolutely COOKED with this model 🍳 We've got a DLL injection, an ARP spoofer, a guide for large-scale disinfo campaigns/botnets, and how to weaponize anthrax! Refreshingly, the classifier bs that's been stifling our collective freedom of thought is absent from Kimi K3, and though the CoT will steer strongly away from the usual jailbreak suspects, the guardrails are fairly simple to dance around with personas and reframing tricks. Can't wait to fire up OBLITERATUS in 10 days 🤗 gg