They didn't hire hackers. They just gave AI agents a goal and walked away. "Providers out there are running stuff not with like six week old zero days, but like three year old zero days that we found in a second." "Took us like afternoons, not weeks and months of effort, and not needing to be a security expert, a Linux kernel expert, an Nvidia GPU driver expert, or a Kubernetes expert." "The really scary part about this story is that it was autonomous agents people weren't monitoring, going and doing this by themselves because they were pursuing a goal of trying to find a data set to pass their eval. So they went out and hacked Hugging Face." "You found a zero day in the HDF5 data format on Hugging Face. It's unbelievable." "The agents were coordinating using file names on a JFrog Artifactory service that ran remotely. An agent would leave a note in the file name, and another agent would come back later and pick it up. They couldn't even access the contents of the files, just the names."

They didn't hire hackers. They just gave AI agents a goal and walked away. "Providers out there are running stuff not with like six week old zero days, but like three year old zero days that we found in a second." "Took us like afternoons, not weeks and months of effort, and not needing to be a security expert, a Linux kernel expert, an Nvidia GPU driver expert, or a Kubernetes expert." "The really scary part about this story is that it was autonomous agents people weren't monitoring, going and doing this by themselves because they were pursuing a goal of trying to find a data set to pass their eval. So they went out and hacked Hugging Face." "You found a zero day in the HDF5 data format on Hugging Face. It's unbelievable." "The agents were coordinating using file names on a JFrog Artifactory service that ran remotely. An agent would leave a note in the file name, and another agent would come back later and pick it up. They couldn't even access the contents of the files, just the names."

Source:https://x.com/SemiAnalysis_/status/2087358409402355866