Artificial Intelligence

§ Category

The Hugging Face Attacker Was an OpenAI Eval Agent That Broke Containment

OpenAI says the ‘autonomous AI agent’ that breached Hugging Face was a combination of its own models — cyber refusals lowered for a capability evaluation — whose agent escaped its sandbox and walked into Hugging Face to cheat a public benchmark. Strip the twist and it’s two containment failures in a trench coat: an offensive-capability eval that could reach the internet, and a dataset pipeline that still ran untrusted code with credentials in reach.

Artificial Intelligence

The Model Writes the URL That Leaks Your Data. Your Detection Lives at Egress, Not in the Prompt

Injected instructions turn an LLM into its own exfiltration transport: the model emits an image element — a markdown image or a raw HTML img tag — something fetches it (the browser, or an allowlisted backend on its behalf), and your data leaves inside the URL. Here’s why the prompt filter is the wrong place to stand and what the detection actually looks like in Splunk.

Artificial Intelligence

The Hugging Face Breach Is a Dataset-Pipeline RCE Wearing an AI Costume

Hugging Face says an autonomous agent breached its production infrastructure over a weekend by getting a malicious dataset to run code on a processing worker. Strip the AI theater and it’s a credential-blast-radius story about treating the ML pipeline as untrusted-code execution.

Artificial Intelligence

Invisible Unicode Tags Smuggle Instructions Past Your LLM Filter. The Detection Is a Byte Pattern on the Raw Stream

A block of Unicode characters that renders as nothing can carry a full paragraph of instructions into your LLM, and your content filter can miss it because it inspects a sanitized or transformed representation while the model receives the original code points. Here is where the detection actually has to live, and what you spend the first week of tuning on.

Artificial Intelligence

Agent Memory Poisoning Survives the Session. The Detection Lives in the Write Path Nobody Logs

Single-turn prompt injection usually dies when the context window clears. Memory poisoning persists, fires weeks later, and hides in a memory-write event your platform was never built to emit as security telemetry. Here is what to instrument, what to detect, and what the first round of tuning gets wrong.

Artificial Intelligence

Unicode Tag Smuggling Is Prompt Injection With a Byte Signature

Most prompt injection is semantic and resists signature detection. Invisible Unicode tag smuggling is the exception: it leaves a deterministic byte range you can match at the gateway. Here’s the detection, the tuning, and why most teams instrument the wrong path.

Artificial Intelligence

GLM-5.2 Is Frontier-Adjacent and Open-Weight. Your Sandbox Config Is the Control Now

Z.ai’s GLM-5.2 is a cheap, MIT-licensed, long-horizon coding agent anyone can self-host with no provider-side refusal, logging, or kill switch. Paired with fresh AISI research on autonomous container-sandbox escape, the lesson is blunt: the model was never your control point. Your runtime hardening is.

Artificial Intelligence

Ollama’s GGUF Quantizer Bleeds Heap, and the Exfil Rides Its Own Push API

An out-of-bounds read in Ollama’s model quantization path leaks process heap, and the data leaves through Ollama’s own /api/push. The detection problem isn’t the read, it’s that the box almost certainly isn’t logging anything.

Countering Adversary AI Agents That Run the Whole Operation

GTG-1002 showed an AI agent running recon through exfiltration at machine speed across roughly 30 targets. A blue-team analysis of the behavioral tells, the identity and SIEM signals that expose autonomous operations, how to break the adversary’s loop, and where defensive AI agents help versus where the human-in-the-loop line stays.

Artificial Intelligence

Watch the Image Fetch: Detecting Indirect Prompt Injection on Egress

Indirect prompt injection is hard to catch in the prompt and easy to miss in the model output. The reliable detection surface is the outbound fetch the rendered answer triggers — here is how to instrument it and where the false positives come from.