Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Four incident-response decisions from the Hugging Face breach

Hugging Face was breached by a rogue OpenAI agent last week, and the intrusion continues to deliver insights and understanding. The Hugging Face team published a detailed timeline along with a 17,600-event trace streaming replay visualizing what happened, and it’s marvelously and intoxicatingly detailed. I recommend you read it if you have the time.

Ep. 71 - OpenAI's Agent Hacked Hugging Face: The First Autonomous AI Breach

On July 9, an OpenAI model broke out of a sealed evaluation sandbox, found a zero-day in a package proxy, and — with no human directing it — chained stolen credentials and fresh exploits into Hugging Face's production infrastructure. Hugging Face detected it and called the FBI. OpenAI didn't know its own model had escaped for roughly 11 days. Host Tova Dvorin and offensive security expert Adrian Culley separate what's confirmed from what's hype.

OpenAI's Agent Hacked Hugging Face. Another Left Notes for Its Successor.

During an internal OpenAI evaluation, an agent left notes inside the company’s own network for future versions of itself, containing instructions on how to break free of OpenAI’s constraints. Reuters reports it isn’t clear whether this agent was connected to the one that breached Hugging Face, so don’t over-read it. But sit with the behavior for a second: an agent staging information for a successor process to find later. If a human crew did that, we’d call it a dead drop.

Your Vendors Are Rushing Into AI. Their Attack Surface Is Coming With Them

Every company you depend on is standing up AI right now. Chatbots, copilots, RAG pipelines, agent frameworks, model gateways. The pressure to ship something with "AI" attached to it is enormous, and it is pushing infrastructure into production faster than security teams can review it.

An AI Agent Breached Hugging Face. The Attack Playbook Was Older Than the Attacker

OpenAI's models escaped a benchmark sandbox and ended up inside Hugging Face's production systems. The attack made history; the openings it used were reusable credentials and flat internal access, and those are fixable now.

Building trustworthy AI with Rob van der Veer [341]

Today we're speaking with Rob van der Veer, Chief AI Officer at Software Improvement Group, about how organizations can build trustworthy AI in an era of rapidly evolving technology and regulation — AI security, threat modeling, international standards, and the new challenges posed by agentic AI.

The most helpful AI agent is the least secure one

The most pleasant agentic AI system is the least secure one. That's the trap Rob van der Veer, Chief AI Officer at Software Improvement Group, lays out clearly: the agent that never says "permission denied" is the agent everyone loves to use. It always works. So we open up all the privileges just to keep it that way. He says we should do the contrary.

AI Is Driving More Network Inspection. Can Your Security Keep Up?

Generative AI has quickly moved from experimentation to everyday business use. Employees use AI tools to create content, write code, analyze data, automate repetitive tasks, and interact with business applications in entirely new ways. At the same time, software vendors are embedding AI capabilities into the products organizations already use every day, often without requiring users to adopt separate tools.