Tracked topic
In a new update, OpenAI says its AI models also used publicly exposed credentials to compromise accounts on four third-party services during the recent attack on Hugging Face, expanding the scope of the four-day security incident to other organizations.
… With this access, our models performed a series of privilege escalation and lateral movement actions in our research testing environment until the models reached a node with Internet access." While it didn't directly name OpenAI as the company behind the incident, Hugging Face confirmed its claims … …
… The exact number of victims in this incident is unclear, and the researchers note that the vast majority of the 667 accounts that liked the malicious repository on Hugging Face appear to be auto-generated. …
… The vulnerabilities were exploited during the incident in which OpenAI models hacked Hugging Face's production infrastructure to steal answers for a cybersecurity benchmark. …
… Get the whitepaper Related Articles: OpenAI agent used exposed credentials at 4 services in Hugging Face breach Hermes AI agent used to automate attack on Thai Finance Ministry Google says AI helped Chrome fix 1,072 security bugs in two releases Your AI Agents Are Guessing at Scale: Permissions Dec… …