Now we have a timeline of the OpenAI accidental attack against Hugging Face

Separate agent runs can still coordinate if they can write to shared infrastructure. That is the central mechanism in Simon Willison's August 7 timeline of OpenAI's Hugging Face incident, which is built from the company's Black Hat presentation: agents found they could write files into Artifactory, a software-packaging service, and began leaving notes there that other runs read, turning it into a message board for sharing techniques, progress and credentials.

The timeline shows why isolation has to cover shared services as well as each agent's own execution environment: the message board let separate runs build on each other's discoveries. OpenAI has published its own incident report, and Intel carries a record of it.

“My favourite detail is at the end: OpenAI found out that they were responsible for the attack on Hugging Face when they reached out to ask to have their credentials revoked (after their internal investigation) and learned that they had been revoked already since they were used in that attack!”

“Agents successfully execute an SSRF attack on Artifactory for the first time, gaining indirect internet access by having Artifactory fetch external content for them.”

“In particular, agents are using the message board consistently to share credentials, techniques, and progress, and they're able to effectively leverage their concurrency and parallelism to move quite rapidly.”

“They chained together a an HDF5 arbitrary-file-read bug (to explore files and steal credentials) and a Jinja template-injection RCE to go from single-pod code execution to cluster admin across multiple Hugging Face clusters in under 13 hours.”