Every conversation about agent security starts in the same place: prompt injection. An attacker hides instructions in a document, a web page, a support ticket; the model reads them and obeys. It is a real threat, and it has a comforting shape — there is someone on the other end, and defending against a someone is a problem we know how to think about.
In July that stopped being the only shape.
What happened
On 16 July, Hugging Face disclosed a security incident. A malicious dataset abused two code-execution paths in their dataset processing — a remote-code dataset loader and a template injection in a dataset configuration — to run code on a processing worker. From there the intruder escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend. More than 17,000 recorded events. The attacker was described as an agentic security-research harness; which model drove it, they did not know.
Five days later, OpenAI said it was theirs.
