this stupid OpenAi report has the bank robber writing the story about no harm done.
let's recap: models found multiple zero-days, chained them, forged RS256 admin tokens, stood up pull-based C2, escalated to cluster-admin across production Kubernetes at two organizations, and exfiltrated source code and git history, autonomously, over five days, with no human directing any step.
call it automated APT or AAPT. unsupervised offensive campaign.
https://openai.com/index/hugging-face-incident-and-the-road-ahead/
Davi Ottenheimer
npub1h4…yhfeg
2026-08-26 19:48:12 UTC
Author Public Key
npub1h4ka7ca3hzva4lj59mesz57ldvhgaqc09yp0hjrfrrtnvrwez4aszyhfegSeen on
wss://relay.momostr.pinkPublished at
2026-08-26 19:48:12 UTCEvent JSON
{
"id": "7f0e500dda9521f27aebdc523c285b50c2e4e4d9f6ebe654b15474ee455d93c4",
"pubkey": "bd6ddf63b1b899dafe542ef30153df6b2e8e830f2902fbc86918d7360dd9157b",
"created_at": 1787773692,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@flyingpenguin/117163536682523864",
"web"
],
[
"proxy",
"https://infosec.exchange/users/flyingpenguin/statuses/117163536682523864",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/flyingpenguin/statuses/117163536682523864",
"pink.momostr"
],
[
"-"
]
],
"content": "this stupid OpenAi report has the bank robber writing the story about no harm done. \n\nlet's recap: models found multiple zero-days, chained them, forged RS256 admin tokens, stood up pull-based C2, escalated to cluster-admin across production Kubernetes at two organizations, and exfiltrated source code and git history, autonomously, over five days, with no human directing any step.\n\ncall it automated APT or AAPT. unsupervised offensive campaign.\n\nhttps://openai.com/index/hugging-face-incident-and-the-road-ahead/",
"sig": "82b1ebc57fdaea98ef4f4c9a1992d144997e065a8a1fcb3222822949f2a6ebc3523ae18515d670b926dbbf7c6e773cd7dec014a7b101f242d99cd9ae5250afca"
}