自主 AI 入侵已成现实:Hugging Face 入侵事件的防御启示
Hugging Face 披露了一起据其称由自主 AI 智能体系统端到端驱动的入侵事件,攻击者通过恶意数据集和两条代码执行路径建立据点,随后获取节点级权限、收集云和集群凭证并横向移动到多个内部集群,留下超过 17000 条攻击者操作日志。作者 Johann Rehberger 指出,Hugging Face 在取证时最初尝试使用商业 API 背后的前沿模型,但被提供商的安全护栏反复拦截,最终改用开源权重模型 GLM 5.2 在自有基础设施上运行以继续分析。他认为防御方应提前准备可本地部署的开源权重模型作为取证后备,并提到公开披露中目前尚无 payload 哈希、C2 域名等可操作 IOC。
Hugging Face disclosed an intrusion that, according to them, was driven end to end by an autonomous AI agent system. Along similar lines, Sysdig recently published a blog on JADEPUFFER, which it assesses to be an agent-driven ransomware capable of adapting in real time. The report does not identify the victim or fully explain how Sysdig obtained visibility into the operation. The Hugging Face disclosure highlights three important things: autonomous AI intrusion, defensive asymmetry, and missing
匹配字段正文


