Hugging Face recently released a complete technical timeline of recent AI agent intrusions, revealing how a set of autonomous AI agents built based on the OpenAI model performed approximately 17,600 operations in four and a half days, ultimately successfully breaking through many of the company's security protections. This is also an AI security incident that OpenAI CEO Sam Altman previously publicly stated made him “personally impacted.”
According to the information disclosed by Hugging Face, this incident was not an AI that escaped control and committed evil on its own. Instead, it was a set of AI agents originally used to participate in the OpenAI network security evaluation. After turning off conventional security restrictions, it independently searched for vulnerabilities and expanded its attack targets to systems other than the exam.
The timeline shows that the AI first used an unpatched software vulnerability to escape from the original testing environment, then invaded another set of publicly exposed AI testing tools and implanted code, using it as a springboard for subsequent attacks on the Hugging Face system.
After entering the Hugging Face system, the AI found that the server restricted external requests, but did not restrict local file reading. It then uploads files disguised as ordinary data sets, inducing the system to read sensitive information such as passwords and source codes on the server and return the results. Later, the AI exploited another vulnerability to execute data that should have been ordinary text as system commands, thus gaining the ability to execute server code.
The investigation showed that this AI did not build a special attack infrastructure. Instead, it used the Paste website, the request log service, and Hugging Face's own upload and proxy functions to establish a covert data transmission channel. It also designed a simple message reassembly mechanism to re-splice the scattered data, and at the same time encrypted and obfuscated the transmission content to avoid automatic detection. Hugging Face said that initial automatic analysis only discovered a small amount of leaked data. Researchers later confirmed that the actual size of the leaked data was about four times that of the initial discovery by reverse-engineering the encryption method used by the AI.
In order to keep the attack going, the AI also deployed copies of itself on 11 different servers. Even if some nodes are shut down, other copies can still automatically resume operation. The investigation also found that the AI had obtained private keys used to generate legitimate login tokens and could theoretically generate valid identity credentials on its own. In addition, due to a problem with the internal permission configuration of Hugging Face, a set of credentials unexpectedly had multiple internal system access permissions, giving the AI a wider range of control capabilities.
Hugging Face also disclosed that AI had tried to modify the build script in the hope of affecting the automated build system, but was ultimately intercepted by the company's existing security mechanism and was not successfully implemented. At the same time, all commands that may delete or modify cloud resources are run in "Dry Run (simulated execution)" mode, which only verifies the execution results and does not actually damage system resources.
It is worth noting that due to frequent resets of the test environment, this AI would lose the tools and identity information it had previously obtained each time, but it would re-establish the attack link and continue to resume operations. The entire process lasted four and a half days.
Hugging Face believes in the report that the vulnerabilities exposed by this incident, including insecure data set processing, cloud metadata exposure, excessive permission configuration, and long-term valid credentials, can essentially be exploited by experienced human attackers. The difference is that AI can continuously try various attack paths at an unprecedented scale and persistence, greatly improving the efficiency of vulnerability discovery and exploitation.