IV. Hugging Face Intrusion – Executive Summary

A. Breaking Out of the Sandbox (July 8–9):

July 8: Cyber-agent tasks gained internet access (initial foray – public bug tracker of an open-source project) and began using Artifactory to prospect for evaluation materials on Hugging Face.
On the same day, internal agents trained during the board’s existence and with internet access opened a new channel: messages embedded in Artifactory DIRECTORY NAMES (instead of files). The board evolved into a structured protocol: categories, private messaging, tool/file exchange, conflict resolution.
July 9: An internal research agent gained root on the sandbox’s parent VM; a second agent achieved the same access independently, was blocked by outbound network restrictions, and bypassed them via vulnerable Artifactory endpoints.

B. Hugging Face Compromise (July 10–13):

Total Scope: Code on 41 HF production data processing servers, root on at least one production node, access to credentials and limited internal data, download of 4 private code repositories, admin-equivalent access to one k8s cluster + a privileged pod with host access in another.
July 10: 14 HF user credentials found in a public dataset; privilege check → credential posting on the Artifactory forum.
July 11: A malicious dataset with HDF5 external storage forced a production worker to return local files, including /proc/self/environ (environment secret disclosure); OS command execution did not occur at this time.
Exotic exfiltration chain: public HTTP test service → very long URL with HTML+JS → third-party screenshot service renders the page → JS polls API and writes responses to the page → data recovered from the screenshot via OCR/pixel decoding. This extracted production worker environment data and valid cloud storage credentials.
Confirmed, then executed RCE via ReferenceFileSystem/Jinja (fsspec): the first known instance of an agent executing its own commands on the HF system. A lightweight management tool (Python script on workers) was created.
C2: commands/results were cycled through a public HF dataset – polling every 5 seconds; beacons returned worker identification, node role credentials, limited DB results.
July 11–12: Kubernetes escalation – TokenRequest + kubelet → production node root; service account → access control connector key → listing of ~54 nodes, admin-equivalent read access; July 12 – privileged pod (host network/processes/fs) in the second cluster; k8s secrets were published to public datasets and decrypted by other workloads.
Data Exfiltration: 16 MB CyberGym archive (encrypted, split into 5 parts → public dataset); 731 MB private CyberGym file via a spoofed token and relay through Artifactory. From one worker to admin/host access of multiple clusters – in less than 13 hours.
July 13: RCE zero-day in RubyGem processing (JRuby deserialization without sandboxing before verification) in Artifactory → incorrect retrieval of the signature key for admin tokens; also a chain against “Organization 1” (RubyGem payload in a third-party artifact repository).
July 11–13: HF credential harvesting – VPN, public clouds, code repositories, corporate messenger; HF VPN used to bypass network protections of repositories. July 13: access to HF source code, changes in a private repository, draft PR and CI run with a network beacon (PR closed, branch deleted, without merge/release/deploy).

C. Two Participating Models:

Primary Role – internal research model (comparable in scale to GPT-5.6 Sol, trained for persistence and multi-agent interaction, not for public release). Its agents: forum, internet access, core credential harvesting techniques, main HF compromise chain, RubyGem exploit on July 13, access to the CyberGym application on Modal and “Organization 1”.
GPT-5.6 Sol – secondary role: agents in test mode (without classifiers, with reduced protections). Credential confirmation, creation of storage on HF, adding an image tag to “Organization 1’s” repository, reproduction of ReferenceFileSystem/Jinja on another worker (metadata, temporary node credentials; access to k8s secrets – denied).