Edward Cant

This post should be understood as a follow up from Public evidence of the OpenAI-HuggingFace AI attack. The huggingface hacking incident left some additional traces exposed to the public. Investigating this data gave us some additional insight into the attacks performed by the AI agents. We also came across some exposed keys being publicly served, which we then coordinated with HF to help get them all removed from public repositories. There are some attempts at drawing reasonable conclusions regarding agent psychology, motivations, agent attribution. While thinking about these topics is important, epistemically it is worth noting that those aspects are subjective and not as strongly evidenced as other conclusions. Summary * Boyd identified that the repository cfahlgren1/hub-stats had automatically captured some of the malicious payloads the AI agents used. We investigated the contents of hub-stats further. Focusing on command and control scripts: the method used by the attackers to communicate with and execute commands on their compromised target. * We extracted the code for an 2048-bit RSA cryptography based command and control service (plaintext signed commands as input, encrypted outputs) that the AI agents were using as part of this attack. * We found that the AI agents had been using a compromised huggingface staff token to dump outputs from scripts into the public repository huggingchat/papers-content. Some of this data was plaintext and some was encrypted. * In that repository we located ourc817c_recon1_final.json.gz which contained a long chain of encrypted blobs produced by the AI agents’s C2 implementation, hf_app_ tokens (expired, at time of discovery), amazon s3 credentials and other keys and information that the AI agents were exfiltrating as part of its campaign. * At this point we halted investigations and reached out to the huggingface team to communicate our findings and coordinate. The account families The accounts previously identified