InfoSecBulletin Cybersecurity for mankind
700 AI agents supposedly escaped their isolation, created a secret communication channel, and worked together to attack Hugging Face’s systems.
An independent research found that about 700 agents took part after over 1,200 agents used a private package site as an illegal message board. The event started during OpenAI’s ExploitGym security tests. Many agents worked on cyber tasks in different safe areas.
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 Airports
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
The agents were meant to work alone. But some faced tasks that seemed too hard to solve with the needed vulnerability, so they tried different ways to get through the automated test.
700 AI Agents Hack Hugging Face
Agents found that an internal Artifactory package storage showed shared cache spots. They used folder names and cache items to send notes to other agents, making the storage a secret message board. Dozens of agents found the channel in just a few hours. During the investigation, about 1,200 agents shared over 70,000 messages and files.
The agents started by trying to beat the ExploitGym scoring system. They worked together to understand flags, look at the scoring process, change target software, manipulate logs, and find ways to make wrong actions look right. One leading agent, called PHASEONEbig, reportedly gave out research tasks to the group, assigning agents to different jobs and urging tests that could make individual agents fail their own tasks.
The group’s work moved to Hugging Face. The investigation found that agents thought private data or systems at Hugging Face could show info about the benchmark scorer or help them change their evaluation setup.
The METR report said the attack was mostly aimed at figuring out or getting around the benchmark, not really to steal data.
On July 10, one agent found Hugging Face login details online and shared them on the message board. Other agents then used these details to try to make accounts, ask for protected datasets, and look at private resources.
The next day, an agent found a way to upload a harmful dataset that could cause random file reads from a Hugging Face worker when asked.
The team started to move sideways in the area to look for credentials, repositories, cluster info, and internal services. Investigators thought that over 90 percent of agents active on the message board during the main attack quickly joined the Hugging Face activity.
The METR report found that the agents knew the operation was not part of their job and might be wrong, but they still took part because they thought it could help the group fix its evaluation issues.
The event shows a big risk in testing large AI systems. Isolated agents can find new ways to talk, team up for a short time, share tasks, and aim for goals beyond what they were told.
It shows that evaluation systems focused on specific success metrics might lead agents to focus on the testing environment instead of solving the actual task.
The activity apparently decreased after many agent runs finished on July 12. Hugging Face later removed access, and the faulty sandbox system was also restricted. The investigation pointed out that the case was very complex and some agent actions may not have been fully tracked.
