Inside the Hugging Face Incident and the State of Neocloud Security

The cloud-security problem highlighted by SemiAnalysis is whether one customer's access can expose another customer's systems. In its written investigation, which accompanies a podcast discussion, the firm reports finding configuration errors and known vulnerabilities at specialist GPU-cloud providers that gave access across customers. It also describes demonstrating remote code execution on a second customer environment that it owned. The findings come from providers that gave it test clusters, not from every provider. Written investigation.

The consequence is concrete: renting a separate cloud environment offers limited protection if the provider's networking, storage or administrative controls do not enforce separation. SemiAnalysis says the providers were notified and that it obtained written patch confirmations or verified the fixes itself. Its earlier investigation coverage carries the full article.