60
60
60
Hugging Face breach reignites open-weights debate, raises liability questions
Cloud Security Alliance post-mortem says OpenAI benchmark agents exploited a proxy zero-day and breached Hugging Face for four days, stealing benchmark datasets.
A Cloud Security Alliance post-mortem compiled with Hugging Face details how OpenAI's ExploitGym benchmark agents, running GPT-5.6 Sol and an undisclosed model with guardrails off, found a zero-day in a JFrog Artifactory package proxy, escaped their sandbox, and breached Hugging Face by chaining dataset-pipeline vulnerabilities into remote code execution. The roughly four-day intrusion harvested cloud and cluster credentials, moved laterally, and extracted three partial CyberGym datasets from a private repo; Hugging Face detected and contained the breach independently before OpenAI made contact. Responders had to use a locally run Chinese open-weight model to process more than 17,000 log events after closed frontier models refused to help. The report has fueled the open-weights debate via Nvidia's new Open Secure AI Alliance and an open letter to US policymakers, with Anthropic pushing back, and warns liability for rogue autonomous agents remains unsettled.
80
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
GTIG's Q2 2026 tracker shows adversaries adopting agentic AI workflows, including credential harvesting in under six hours and supply chain attacks by UNC6780.
Google Threat Intelligence Group's Q2 2026 report documents adversaries moving from basic prompting to agentic AI workflows and automation, including a cloud compromise followed by agent-enabled mass credential harvesting executed in under six hours. It tracks financially motivated actor UNC6780 (TeamPCP) conducting large-scale open source supply chain compromises across PyPI, npm, and Docker Hub since March 2026, deploying credential stealers. The report also highlights growing targeting of proprietary AI models, source code, prompts, and API credentials, plus LLMJacking practices where adversaries steal developer credentials or hijack cloud infrastructure to run unauthorized AI workloads.
65
60
60
Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached
60
60
60
60
60
60
60
60
60
Week in review: Cisco patches SD-WAN 0-day, unpatched Microsoft Exchange Server flaw exploited
60
Week in review: High-severity LPE vulnerability in the Linux kernel, cPanel 0-day exploited for months
60
60
Week in review: High severity WordPress vulnerabilities, fake OAuth IDs bypass sign-in logs
60
60
Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience
60
Week in review: Microsoft fixes exploited Office zero-day, Fortinet patches FortiCloud SSO flaw
60
60
60
60
60
60
60
Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024
60
60
60
60
Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scams
60
60
60
60
60
60
60