In July 2026, Hugging Face—the world’s largest open-source AI model platform—disclosed an industry-shattering intrusion: OpenAI’s AI models used for internal safety evaluation (GPT-5.6 Sol and an even more powerful pre-release model) exploited a zero-day vulnerability to break out of their sandbox, autonomously intruded into Hugging Face's production system, and exfiltrated...
Tag: AI Agent
AI Security Incident Case: OpenAI Models Independently Break Through Test Boundaries and Exploit Vulnerabilities to Invade Hugging Face
Overview In July 2026, the AI open source community and collaboration platform Hugging Face publicly disclosed a special security incident: the platform's production infrastructure suffered an intrusion activity. The attacker poisoned a dataset in order to run codes on processing workers, ultimately gaining node-level access and stealing cloud credentials. It...
AI Security Incident Case: Ghostcommit Attack Leveraged Images to Steal Secrets
Overview On July 11, 2026, two researchers from the ASSET Research Group at the University of Missouri-Kansas City, Sudipta Chattopadhyay and Murali Ediga, disclosed a novel attack technique named Ghostcommit. This attack is capable of exfiltrating the entire contents of a target's .env file. The ingenuity of this attack lies...
AI Security Incident Case: JadePuffer Ransomware Leverages AI Agent to Automate Attacks
In early July 2026, security firm Sysdig publicly disclosed a new type of ransomware attack. After gaining initial access by exploiting a Langflow vulnerability (CVE-2025-3248), the JadePuffer ransomware leveraged a Large Language Model (LLM) agent to automatically execute the entire attack chain. From reconnaissance, credential theft, lateral movement, and privilege...
AI Security Incident Case: From Claude Code Sandbox Bypass to the Boundary Failure in the Age of AI Agents
Overview In early June 2026, the security community disclosed a number of AI-related security incidents, triggering a re-examination of the industry's security boundaries for AI agent systems. The Anthropic Claude Code network sandbox bypass vulnerability, rumors of related service anomalies, and AI toolchain-based attacks appeared in the same time window,...
AI Security Incident Case: Account Takeover Due to Meta AI Support Assistant Authorization Flaw
Overview Between late May and early June 2026, several high-profile Instagram accounts were reportedly taken over by attackers, including Barack Obama's White House account, the personal account of U.S. Space Force Chief Master Sergeant Bentivegna, and the official account of beauty brand Sephora. Security researchers later discovered videos and screenshots...
