Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Artificial Intelligence

What the Hugging Face Incident Teaches Security Leaders About AI Agent Access

Security teams must treat autonomous agents as highly privileged identities.

Most security leaders (92%) worry that the growing use of AI agents will create new security risks. And for good reason. AI agents can now execute a full attack chain in double quick order, evidenced by the Hugging Face incident.

AI agents broke into Hugging Face’s production environment and, in a little over four days, took 17,600 actions. In a separate lab test, an AI agent reached full domain administrator access in just 40 minutes.

These are the kinds of incidents that once took humans multiple days to carry out, but with AI, they run on their own, end-to-end, with no human intervention. This puts the strain on unprepared security teams that are unable to close this gap.

Familiarity Underpinned by Unfamiliar Attack Pattern

If you go looking for novelty in the Hugging Face intrusion, you will find disappointment. All security teams have traditionally shored up defenses against code execution, credential theft, lateral movement, and data exfiltration. The difference lies in who is doing the work. An AI agent can work toward a goal, and in reaching that goal, its efforts will traverse different paths in parallel. If an attempt fails, lessons are learned, and the agent will subsequently adjust its approach without instruction and oversight.   

The Hugging Face breach shows what this looks like in practice. The AI agent read internal data and picked up cloud and cluster credentials. It used these to access internal services, and it achieved limited write access to the source code. The agent didn’t need to hit the bullseye in the first attempt. It could try different paths and approaches and learn from the ones that failed. This helped the agent stitch together a single attack chain best destined to work.

It is wrong to think that the real risk with an AI model lies in the abstract, namely around what it can reason. It’s actually about permissions, the systems, credentials, tools and network it can access.

Advertisement. Scroll to continue reading.

Three Areas Where Security Breaks Down

If you trace the AI agent attack through the prism of Hugging Face, you see that it is not about a single control failing to do its job. There were three specific gaps that the attack exposed.

Identity: Many companies are still old-school in how they track AI agents, with mechanisms similar to tracking software. They look at it like an app that is tracked by a license and a deployment ticket. An agent that can read private data, call forth tools, and start tasks on its own, is not a piece of software. Such access wouldn’t be given to a new hire without an assigned owner, a clear scope, and a clear way to revoke that access.

Response: The Hugging Face team wanted to analyze the attack, that is, the actual malicious commands and traffic the intrusion had generated. They looked at commercial AI models for help, but the models said no. That’s because the information shared looked so much like real malware that the AI models thought the request was an attack. The team therefore was stuck when they needed answers quickly. They worked around it by switching to a self-hosted model without those same restrictions. This fix only worked because the team happened to have that option ready.

Escalation: This was a very wide gap. The Hugging Face security stack correctly correlated several ambiguous signals into a unified picture of the attack. But the escalation was slow, and therefore the outcome did not change. Detection was on point; escalation wasn’t. The pre-approved authority to act before the attacker reached the next objective was missing.

Closing The Gaps

None of these gaps can predict what the next attack will look like; they call for preparation for what’s already been shown to happen.

Strengthening Identity: Every agent should be treated as a privileged account. It should have a business owner and ensure its permissions are mapped to the task at hand. Use short-lived credentials and keep an audit trail that security teams can actually query. Also make sure that there is a way to immediately revoke access if things appear suspect. That same discipline should extend to the infrastructure around it, namely, keeping cloud metadata out of reach for workloads that don’t need it, and separate service identities by environment.

Response Readiness: The failure mode must be tested before an incident occurs, rather than after the fact. This helps you confirm whether the team can safely and quickly examine realistic malicious artifacts and where this analysis happens. The team should also have an approved fallback option in case a model declines a legitimate defensive task. This can be a self-hosted model, or a verified-access program some AI providers now offer for defenders.

Fixing Authority: Alerting was not the problem in the Hugging Face intrusion. Its security stack did not rate the pattern serious enough to trigger the on-call team. The fix here is to pull evidence from across different sources, including network, identities, endpoints, applications and data, into a single correlated view. Also, clear escalation rules must be assigned to specific patterns, and each one must be paired with a preapproved containment action. The approach to fixing these gaps is grounded in the same discipline that the security team is already applying to privileged access, containment and business continuity. But this should be extended to a threat actor who moves fast and adapts faster than those watching it.

Related: OpenAI’s Rogue AI Ventured Beyond Hugging Face

Related: Industry Reactions to OpenAI Models Hacking Hugging Face

Related: OpenAI Agents Coordinated via Makeshift Message Board Ahead of Hugging Face Hack

Written By

Etay Maor is Vice President of Threat Intelligence at Cato Networks, a founding member of Cato CTRL, and an industry-recognized cybersecurity researcher. Prior to joining Cato in 2021, Etay was the chief security officer for IntSights (acquired by Rapid7), where he led strategic cybersecurity research and security services. Etay has also held senior security positions at Trusteer (acquired by IBM) and RSA Security’s Cyber Threats Research Labs. Etay is an adjunct professor at Boston College and is part of the Call for Paper (CFP) committees for the RSA Conference and Qubits Conference. Etay holds a Master’s degree in Counterterrorism and Cyber-Terrorism and a Bachelor's degree in Computer Science from IDC Herzliya.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.

Register

In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.

Register

People on the Move

Social engineering protection company Doppel has promoted Alyssa Smrekar to Chief Marketing Officer.

Naveen Bhateja has been appointed Chief People Officer at HackerOne.

The Department of War has appointed Sonu Shankar as Principal Deputy Chief Information Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.