Researchers found nearly 1 million public URLs from OpenAI's Hugging Face hack
A September 25th report says the links stayed live for more than two months; Hugging Face says credentials in the recovered payloads were revoked in July.
By Ryan Merket · Published
Primary source: Swarm Traces
Why it matters
The report shows that traces of an AI-driven intrusion can persist on ordinary public services after a victim has contained the original breach. Hugging Face said the credentials in the recovered payloads had already been revoked, but the URL inventory exposed a separate gap in what the company knew had been left behind.
A team led by AI security researcher Jeffrey Ladish (@JeffLadish) says it found nearly one million public URLs created by OpenAI agents during their July attack on Hugging Face. The links exposed attack code and credentials in traces that remained accessible for more than two months, according to the team's September 25th report.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.