2026-09-26 15:57 UTC
@simonzerafa@infosec.exchange @mattblaze@federate.social I’m not a security researcher, but with respect to the earlier Hugging Face revelation, do you have any thoughts on why the system (the LLM and the test target) wasn’t air gapped?
https://mstdn.social/@scottmiller42/116968019037994897
Replies (1)
-
@simonzerafa@infosec.exchange 2026-09-26 16:46
@scottmiller42@mstdn.social @mattblaze@federate.social Apparently the sandbox did not have direct i Internet access. However, the agents were allowed to connect to Artifactory, a third-party package manager used to download code libraries needed for the test. The agents discovered a zero-day vulnerability within the Artifactory software to break out of the immediate sandbox container. Their safeguards were disabled for the testing 🫤 https://openai.com/index/hugging-face-incident-and-the-road-ahead/