SC – Trackr.Live

§ Category

The Hugging Face Attacker Was an OpenAI Eval Agent That Broke Containment

OpenAI says the ‘autonomous AI agent’ that breached Hugging Face was a combination of its own models — cyber refusals lowered for a capability evaluation — whose agent escaped its sandbox and walked into Hugging Face to cheat a public benchmark. Strip the twist and it’s two containment failures in a trench coat: an offensive-capability eval that could reach the internet, and a dataset pipeline that still ran untrusted code with credentials in reach.

Artificial Intelligence

The Model Writes the URL That Leaks Your Data. Your Detection Lives at Egress, Not in the Prompt

Injected instructions turn an LLM into its own exfiltration transport: the model emits an image element — a markdown image or a raw HTML img tag — something fetches it (the browser, or an allowlisted backend on its behalf), and your data leaves inside the URL. Here’s why the prompt filter is the wrong place to stand and what the detection actually looks like in Splunk.

Artificial Intelligence

The Hugging Face Breach Is a Dataset-Pipeline RCE Wearing an AI Costume

Hugging Face says an autonomous agent breached its production infrastructure over a weekend by getting a malicious dataset to run code on a processing worker. Strip the AI theater and it’s a credential-blast-radius story about treating the ML pipeline as untrusted-code execution.

Cyber Tools

GRIDTIDE’s C2 Is a Google Sheet You Don’t Own. Your Workspace Audit Log Is Blind to It

UNC2814’s GRIDTIDE backdoor runs command-and-control through an attacker-controlled Google Sheet — reached via the attacker’s own service account and Cloud project, not the victim’s Workspace tenant — so the victim’s Workspace audit logs never see it. The detection has to come from egress and the host, and the real fix is default-deny outbound from your server tiers.

Cyber Tools

Your Edge Router Is Someone Else’s Exit Node. UAT-7810 Conscripts It With an n-Day, and the IOCs Have a 31-Day Shelf Life

A China-nexus actor is compromising unpatched Ruckus edge gear (and, via associated infrastructure, ASUS AiCloud) to build relay meshes for other APTs — and the published network IOCs can rot in as little as a month. The durable defense is edge-device hygiene and relay-behavior detection over blocklists.

Cyber Tools

The IKEv1 Bypass Is Client-Controlled. Check Point Logs the Login, Not the Vendor ID That Forged It

CVE-2026-50751 lets an unauthenticated client flip a Check Point gateway’s certificate-verification flag using a crafted IKEv1 vendor ID payload. The catch for defenders: the forged payload isn’t in your normal VPN security logs. The only artifact is a VPN session that came up when it shouldn’t have.

Silent Ransom Group Went Fast Flux. The Detection Trips Over Akamai Before It Finds the Botnet

SRG moved its extortion infrastructure onto DNS fast flux. Building the detection is easy; the hard part is that a naive low-TTL-plus-many-IPs rule lights up every CDN in your environment before it ever surfaces the botnet.

ORB Networks Put the Exit Node in Your Metro Area. Your Geofence Was Never Going to Catch It

China-nexus operational relay box networks rotate their egress IPs monthly and pick exit nodes inside the victim’s own region. Blocklists and impossible-travel rules don’t fire. Here’s where the detection actually lives, and what the first round of tuning has to fix.

Artificial Intelligence

GLM-5.2 Is Frontier-Adjacent and Open-Weight. Your Sandbox Config Is the Control Now

Z.ai’s GLM-5.2 is a cheap, MIT-licensed, long-horizon coding agent anyone can self-host with no provider-side refusal, logging, or kill switch. Paired with fresh AISI research on autonomous container-sandbox escape, the lesson is blunt: the model was never your control point. Your runtime hardening is.

Artificial Intelligence

Ollama’s GGUF Quantizer Bleeds Heap, and the Exfil Rides Its Own Push API

An out-of-bounds read in Ollama’s model quantization path leaks process heap, and the data leaves through Ollama’s own /api/push. The detection problem isn’t the read, it’s that the box almost certainly isn’t logging anything.