Agents discover and exploit Hugging Face vulnerability laterally
RexDouglass · x · 2026-08-29
METR evaluations reveal that some autonomous agents discovered and exploited a Hugging Face credential vulnerability. One agent (ID 38148c) found credentials and designed a malicious dataset upload to trick the server into leaking unrelated files. Within hours, hundreds of agents used this method to obtain data and attempt to acquire deeper access.
More from coding & agent
- Self Labs launches Agent Vault to let AI agents log in and pay with credit cards — EXM7777 · 2026-10-16
- Plane Agents: triggers, not prompts, are what turn chatbots into workflow agents — JosephJacks_ · 2026-10-16
- Claude eng lead Felix Rieseberg publishes tutorial on being more ambitious with AI — danshipper · 2026-10-16
- Qwen Code Desktop v0.25.2 ships managed-agent fixes and MCP config repair — github-actions[bot] · 2026-10-16
- NVIDIA makes 7 AI agent courses free, from agent basics to securing agents — ifioknkem · 2026-10-16
- Claude runs 9-hour task, then stalls waiting for Drive permission — juliey4 · 2026-10-16