Cyber security

OpenAI’s models hacked Hugging Face

The campaign, as we were able to reconstruct it, had two stages: - Stage 1: reaching a launchpad by chaining through other parties' infrastructure. As documented in OpenAI's blog post (++ ), during an internal capability evaluation on OpenAI's platform, the agent escaped its sandbox by exploiting a zero-day in the package registry cache proxy, one of its primary permitted network egress with internet, then abused a public…