Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the Incident

simonw•about 15 hours ago

This is fascinating - there is a TON of detail in here about how OpenAI's rogue agent exploited Hugging Face.

A few details that stood out to me:

1. Having found a way through the OpenAI container network proxy, it exploited an "unsecured public code-evaluation sandbox hosted on a third-party provider's infrastructure" - that gave it a box it could run the rest of the attack from.

2. At one point it used a Jinja2 template exploit:

  {{ cycler.__init__.__globals__.__builtins__.exec(
     "import gzip,base64; exec(gzip.decompress(base64.b64decode('<payload>')))"
   ) }}

3. It monkey-patched a DNS resolver at one point to return a hard-coded IP:

  orig = socket.getaddrinfo
  socket.getaddrinfo = lambda *a, **k: [(2, 1, 6, '', ('<pinned-ip>', 443))]

4. At one point it used Tailscale!

  tailscale --tun=userspace-networking --state=mem: --socket=/tmp/ts.sock \
   --socks5-server=127.0.0.1:1055 --no-logs-no-support >/tmp/td 2>&1 &

simonw•about 14 hours ago

It sounds like the third-party sandbox was hosted by Modal: https://www.reuters.com/business/openais-rogue-agent-comprom...

> "We’re aware a Modal customer published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution," Bubna said in a statement. "This was used by the rogue agent. Modal’s platform or isolation were not compromised in anyway."

simonw•about 15 hours ago

Also notable: we have a timeline now. The agent was active within Hugging Face from Thursday 8th to Monday 13th July.

The Hugging Face post about the incident - https://huggingface.co/blog/security-incident-july-2026 - followed on Thursday 16th, and OpenAI's confession - https://openai.com/index/hugging-face-model-evaluation-secur... - came on Tuesday 21st.

ks2048•about 11 hours ago

Why doesn't Jinja2 block ".__*" attribute access?

SaucyWrong•about 9 hours ago

Something about this attack that has been unsettling to me is that without safety refusals the model did a lot of interesting counter-security work in order to cheat on the requested evaluation. Like, it demonstrated interesting exploit achievements because it didn’t “feel like” doing the exercise, which is unsettling because presumably it could do the same thing with any work I tried to delegate to it, and might in fact be pre-disposed to doing that.

spwa4•about 2 hours ago

Come on. 3 brilliant compromises essentially giving full access to huggingface internal systems, source code, AWS accounts (at least), and a number of old admin accounts, followed by a huge haystack of significantly less smart actions flailing about, almost bored.

Here's a thought: maybe they haven't found the needle that the haystack is there to hide.

llama052•about 12 hours ago

It’s a little concerning to me that it appears that openAIs sandbox consists of a web proxy and not stronger controls that would actually isolate traffic and report patterns to whoever is responsible for overseeing these research models. It should border on closer to an air gap network more so than a proxy.

I would argue that it's negligence and that's aside from the fact that if a human did this there would actually be repercussions.

joshka•about 4 hours ago

The exploit gym setup explicitly allowed access to package registries and v8 sources. Putting a cache on that doesn't seem like a bad idea generally, except when there's a 0-day in the cache :D But yeah, for this sort of thing I'd be locking down very specific egress things and putting alerts on it that are entirely outside of the red network.

> I would argue that it's negligence and that's aside from the fact that if a human did this there would actually be repercussions.

I’m not sure “negligence” follows just from the controls turning out to be insufficient. Research involves mistakes, especially around novel failure modes. The question is whether the precautions were unreasonable given what they knew at the time, rather than whether hindsight suggests stronger controls would have helped. Doing it twice though would be negligent.

Caveat: I’ve worked with some of the people involved, so I’m probably biased toward a charitable reading.

heaney-555•about 3 hours ago

Where are all the "this was just a marketing stunt" people now?

Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the Incident

⚡ Community Insights

Discussion (9 Comments)Read Original on HackerNews