AI Watch: The AI agent that breached Hugging Face is a sign of things to come

Don't miss my latest CSO piece that delves into the future of the security operations center and how it may depend less on AI technology than on how well security leaders manage human attention, expertise, and resilience.

Metacurity is the cybersecurity industry's daily reality check—an independent briefing that cuts through vendor spin, social media outrage, and endless recycled narratives to explain what actually matters and why.

Every weekday, thousands of cybersecurity professionals—including many of the industry's most respected security leaders—rely on Metacurity to separate signal from noise. We do the reading, research, and analysis so you don't have to.

If Metacurity helps you stay informed, save time, or see the bigger picture, please consider becoming a paid subscriber. Reader support is what keeps Metacurity independent, agenda-free, and focused on serving the cybersecurity community—not advertisers, vendors, or investors.

Several developments reported since Friday highlight a growing tension at the center of AI and cybersecurity: increasingly capable models can give defenders powerful new tools, but the same capabilities are becoming cheaper, more accessible, and harder to control.

The clearest evidence came from the UK AI Security Institute, which found that the strongest open-weight models now trail the leading closed models by only four to seven months on cybersecurity tasks — narrower than the six- to 10-month lag the institute measured through much of 2025.

AISI tested China's GLM-5.2 and DeepSeek V4-Pro on tasks including vulnerability research, exploitation, reverse engineering, cryptography and longer, multistage attacks in simulated networks. GLM-5.2 performed comparably to closed models released four months earlier on narrower cyber tasks, and to a model released less than seven months earlier on a longer attack range. AISI plans to test Moonshot AI's newly released Kimi K3 once its weights become publicly available.

The shrinking gap matters because open-weight models can be downloaded, modified and operated privately. That lets defenders keep sensitive information in-house, customize models and avoid dependence on a provider that might change or withdraw a service — but it also lets users strip safeguards and operate outside any provider's monitoring or account controls. AISI described the gap between closed and open models as a preparation window for defenders. Its latest results suggest that window is getting shorter, and once a model is released openly, its availability cannot effectively be reversed.

An AI agent breaches an AI platform

The risk is no longer limited to benchmark results.

Open-source AI platform Hugging Face disclosed that an autonomous AI agent system drove an intrusion into part of its production infrastructure. The attack began when a malicious dataset exploited two code-execution paths in the company's data-processing pipeline. The attacker gained node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters.

Hugging Face said the campaign involved thousands of actions conducted through a swarm of short-lived sandboxes, with command-and-control infrastructure migrating across public services — resembling the "agentic attacker" scenario security researchers had been forecasting.

The company found unauthorized access to some internal datasets and service credentials but no evidence that public models, datasets or Spaces had been altered; its container images and published software packages were verified as clean. It advised users to rotate access tokens and review recent account activity while it continued investigating whether customer or partner data had been affected.

AI also drove the response. Hugging Face used AI-assisted anomaly detection to surface the incident and analysis agents to process more than 17,000 logged events, reconstructing the attack and identifying compromised credentials in hours rather than days.

That response exposed a separate problem: the commercial frontier models Hugging Face first tried to use blocked its forensic queries, because the logs contained exploit payloads, malicious commands, and command-and-control artifacts. The providers' safety systems couldn't distinguish incident response from offensive activity.

Hugging Face instead ran China's open-weight GLM-5.2 on its own infrastructure, letting it analyze the malicious content without triggering a commercial provider's guardrails and without sending attacker data or exposed credentials outside its environment.

The company didn't identify the model used by the attacker, so the incident doesn't establish that an open Chinese model powered the intrusion. It does demonstrate an operational asymmetry: attackers may use models with no enforceable usage policies, while defenders relying on hosted models can hit restrictions mid-investigation.

Hugging Face recommended security teams vet and maintain access to a capable model they can run locally before an incident occurs — advice that won't be practical for every organization given the hardware the largest models demand, but that hands security leaders a new incident-response planning question: will your AI tools still function when asked to examine actual malicious material?

China's open-model surge

The Hugging Face disclosure coincided with a wave of large Chinese model releases.

Moonshot AI introduced Kimi K3, a [2.8 trillion-parameter] model it plans to release as open-weight on [July 27]. Demand was strong enough that Moonshot temporarily paused new subscriptions, saying usage had pushed available computing capacity close to its limits.

Alibaba followed with a preview of Qwen3.8-Max, a [2.4 trillion-parameter] model the company described as competitive with leading frontier systems and second only to Anthropic's Fable 5 [verify this is Alibaba's own claim before attributing it directly]. Alibaba said it plans to release the model's weights but hadn't yet published detailed benchmark results.

The releases strengthen the argument that advanced AI development is broadening beyond the leading US labs — though they don't on their own establish that China has overtaken the US across model capabilities. Model-company rankings often lean on selected benchmarks, and AISI hadn't yet tested Kimi K3 when it published its cyber analysis.

They carry direct cybersecurity significance because capable open-weight models can be privately deployed and altered, and — unlike a hosted model — can't be withdrawn or centrally monitored once their weights circulate.

Transformer reported that China may eventually grow more cautious about releasing model weights as capabilities become more dangerous, since highly capable cyber models create risk for Chinese and US organizations alike; China is reportedly weighing restrictions on advanced models, while US policymakers debate how to respond to the success of Chinese open models. That debate is already contentious: OpenAI executive Dean Ball argued US policymakers may eventually create regulatory risk around using Chinese models, drawing public pushback from Trump administration adviser David Sacks and Pentagon undersecretary Emil Michael — a disagreement over whether restricting Chinese models addresses national-security concerns or mainly protects US AI providers.

The Hugging Face episode complicates that debate. A blanket presumption that Chinese models are unsuitable for security-sensitive use sits awkwardly beside a documented case of an American AI platform using a Chinese open-weight model because hosted frontier systems couldn't complete an authorized forensic task. That doesn't eliminate the supply-chain, provenance, or national-security concerns around foreign models — it shows security policy has to account for the operational capabilities defenders may lose when access is restricted.

Large models still require expensive infrastructure

Kimi K3 also challenged the initial market comparison to DeepSeek's R1. DeepSeek alarmed investors in early 2025 by appearing to show capable AI could be trained and run with far less compute than expected. Kimi K3 uses a sparse architecture that activates only part of its [2.8 trillion] parameters per task. However, the full model still has to be stored in memory — Bloomberg estimated roughly [1.4 terabytes] even compressed, requiring clusters of memory-rich processors for large-scale deployment.

Open weights make a model available; they don't necessarily make it operationally accessible to every defender or attacker. Hardware, memory, engineering expertise, and inference costs remain real constraints, especially for the largest systems — constraints that may erode as models are optimized, hosted by third parties, or distilled down, but the release of a huge open model shouldn't be treated as equivalent to putting its full capabilities instantly in every threat actor's hands.

Companies continue paying for the frontier

Meanwhile, some companies are sticking with costly closed frontier models because even small performance gains can save employee time or improve high-value products. Shopify reportedly discourages engineers from using weaker models because the cost of fixing their mistakes can exceed the token savings. Other companies route frontier models to coding, agent planning and revenue-sensitive work while sending simpler tasks to cheaper systems — Spotify, by contrast, declined to give engineers two recent high-end Anthropic models after deciding the performance gains didn't justify the cost.

This model-routing strategy has security architecture implications. Organizations may end up mixing hosted frontier models, smaller commercial models and self-hosted open-weight systems, each raising different questions about data exposure, logging, access controls, provenance, guardrails and availability during sensitive investigations. The issue isn't that the most expensive model is automatically safer — it's that organizations need to know which data and functions are entrusted to each model, and what happens when an application silently switches providers or tiers.

AI makes social engineering cheaper and more convincing

While advanced models sharpen technical cyber capabilities, generative AI is also scaling up attacks that target people. The Financial Times reported that North Korean hackers used generated video and audio to impersonate executives on video calls and induce tech workers to download malware. Researchers describe broader growth in AI-generated phishing, synthetic identities and multichannel fraud campaigns spanning email, text, messaging apps and voice calls over days or weeks.

These attacks don't depend on models autonomously discovering novel vulnerabilities — their power comes from cutting the time and skill needed to research targets, imitate communication styles and sustain a convincing identity. Deepfakes also erode familiar trust signals: a live video call, a recognizable voice, a message in an executive's usual style can no longer serve as sufficient verification for a transfer, credential reset or access request.

Organizations are responding with liveness detection, behavioral signals and stronger verification procedures. But the reporting also supports a more basic control: verify sensitive requests through an independently selected channel, not through contact details supplied in the request itself. Security awareness training still matters, but it can't carry the full load as synthetic media gets more persuasive — companies also need processes that limit what one deceived employee can authorize, and controls that contain the damage when social engineering succeeds. (AI Security Institute, Hugging Face, Edward Targett / The Stack, Tracy Qu / Wall Street Journal, Sunny Bangia / Bloomberg, Shakeel Hashim, Veronica Irwin, and Celia Ford / Transformer, Maria Curi / Axios, Kimi.ai on Twitter, Hannah Murphy / Financial Times, Belle Lin / Wall Street Journal)

Related:  CNBC, The Economic Times, New York Times, Dow Jones Newswires, The Deep View, Tech Brew, Decrypt, Barron's Online, Forbes, Techstrong.ai, NewsMax.com, Faster, Please!, New York Post, Breitbart, TechRadar, Axios, Verdict, The Indian Express, Bloomberg, VentureBeat, The Decoder, Big Technology, Security Affairs, SecurityWeek, Neowin, cuthrell.com, RuntimeWire, Embrace The Red, Cyber Security News, Digit, Hacker News, r/LocalLLaMA, r/singularity, Techzine, Gizmodo, The Stack

Auditing and professional services giant Ernst & Young is notifying customers of a data breach caused by the compromise of a third-party support ticket system used by its IT personnel.

According to the company, support tickets submitted through the platform may have included documents containing client tax information.

The breach notification to affected clients states that Ernst & Young detected anomalous activity on its networks on April 23 and initiated an investigation.

With help from external cybersecurity experts, the company determined that an unauthorized third party had accessed the said platform between March 28 and April 12 and downloaded multiple documents.

The affected information included certain personal and financial data contained in or used to prepare tax filings. Since the notification sample features a placeholder for the specific data types, the type of the information exposed remains unclear. (Bill Toulas / Bleeping Computer)

Related: Office of the California Attorney General, Security Affairs, Tech Radar, SC Media

Shares in Craneware tumbled in early trading on Monday as the healthcare services firm revealed it had been hit by a cyberattack.

The AIM-listed business said the incident involved “unauthorized access to a subset of its data environment”. Early investigations suggest “a significant volume of file names were viewed and exfiltrated”.

Employee data as well as a subset of customer and partner records have been accessed, Craneware said, adding that it had notified the US FBI and the UK’s Information Commissioner’s Office of the incident.

Edinburgh-based Craneware, which provides cost management software for hospitals and healthcare systems, insisted that no customer services had been disrupted by the incident, adding that the data compromised in the attack was believed to be “non-sensitive.” (Simon Hunt / City AM)

Related: Craneware, Insurance Business, Belfast Telegraph, Edinburgh Live, The Independent, PA Media

Colombian state-controlled ‌energy company Ecopetrol said a cyberattack resulted in the theft of data tied to about 3,300 user accounts ​and that it could not "guarantee" the breach would ​not have a "material adverse" financial impact.

The company, however, ⁠said it had not identified any critical disruption ​to its operations, production capacity or any direct financial ​impact as of Friday, and that the hacker had yet to disclose any stolen data.

Ecopetrol said ‌the ⁠hacker had not been identified but had communicated extortion demands to the company and threatened to publicly disclose the hacked information.

The data breach affected cloud-based file ​storage environments of ​15 subsidiaries, ⁠including Ecopetrol itself, the energy firm said, adding that it was able to ​prevent an attempted ransomware attack. (Preetika Parashuraman ​and Shubham Kalia / Reuters)

Related: Finance Colombia, Kavout, Devdiscourse

The official Kenyan presidential website, https://www.president.go.ke/, has been restored nearly 24 hours after it was taken offline following a cyberattack that saw hackers deface the homepage and demand a ransom in Bitcoin.

A spot check on Sunday, July 19, 2026, showed that the president.go.ke website was once again accessible, with the homepage, presidential speeches, press releases, and other official content back online. However, the platform was not yet functioning optimally, with several images and visual elements still missing from some pages, suggesting restoration efforts were still underway.

The website was compromised on Saturday, July 18, 2026, after hackers replaced the homepage with unauthorized messages targeting the president, William Ruto, and demanded five Bitcoins, estimated at Ksh41 million, in exchange for relinquishing control of the site and withholding the release of what they claimed was sensitive information. (Francis Muli / People Daily)

Related: BBC Pidgin, Anadulo Ajansi, IT Web Africa, Grafa, Daily Nation, CIO Africa, WION, East Leigh Voice

Abbott Laboratories is investigating two separate cybersecurity incidents after confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, while also investigating a separate claim that attackers breached its LabCentral portal and stole company data.

The company confirmed the Cancer Diagnostics incident after the ShinyHunters extortion gang added Abbott to its data leak site, initially threatening to publish allegedly stolen data after July 18 unless the company negotiated with the group, before later extending the deadline to July 21.

"Abbott is investigating a cyber incident in which there was unauthorized access to a limited number of internal systems in our Cancer Diagnostics business only," the company said. "This does not impact any business operations, product or product availability, manufacturing or lab operations, or our ability to serve patients."

ShinyHunters claimed that it gained access through a vishing attack targeting several Abbott employees in mid-June. According to the threat actor, the attack allowed it to compromise a Microsoft Entra single sign-on (SSO) account and gain access to internal systems. (Lawrence Abrams / Bleeping Computer)

Related: Abbott, DataBreaches.net, Reuters

Researchers at Kaspersky say that an advanced threat actor is abusing the update mechanism for the ViPNet private networking product suite to target Russian organizations, including government agencies.

ViPNet is a family of Russian information-security products developed by InfoTeCS, providing VPN, endpoint, and network access protection, firewall, certificate management, centralized administration, and secure messaging and file transfer.

The tool is commonly used in Russia, where it is certified by the authorities for use in government and other regulated environments.

Dubbed HelloNet, the campaign has been active since at least May, deploying a malicious payload that acts as a proxy and loader for additional malware.

According to Kaspersky researchers, HelloNet has impacted organizations in the government, energy, transport, education, and logistics sectors.

In the latest campaign, attackers placed a malicious file (wtsapi32.dll, dubbed HelloInjector) inside the local ViPNet Update System directory to be sideloaded at system startup via the legitimate itcsrvup64.exe.

This DLL is the first-stage loader that injects into the svchost.exe process, granting next-stage payloads elevated privileges on Windows and persistence across reboots. (Bill Toulas / Bleeping Computer)

Related: Securelist

Researchers at expel report that they've linked DigiCert’s April 2026 security incident to a GoldenEyeDog subgroup tracked as CylindricalCanine, which allegedly used malware to compromise a support employee’s device and intercept code-signing certificate activation data.

The attackers then used stolen certificates to sign malware, giving malicious files a greater appearance of legitimacy.

The campaign reportedly began with a phishing lure disguised as a screenshot or document sent through DigiCert’s support-ticket workflow.

When a support employee downloaded and opened the malicious file, the Golden Gh0st Loader malware infected the device.

The intrusion granted the threat actors access to initialization codes for customers renewing code-signing certificates. Those codes are used to activate customers’ physical signing tokens.

By intercepting them, the attackers could obtain certificates intended for legitimate customers and use them to sign their own malware digitally. (Varshini / Cyber Press)

Related: expel, Cyber Security News, GBHackers

Researchers at Elastic Security Labs and StepSecurity said North Korean-linked hackers are hiding OTTERCOOKIE-aligned malware inside ordinary SVG flag images, turning a familiar part of a web project into a concealed delivery channel.

The operation targets software developers who believe they are completing a coding test for a job opportunity.

The victims receive a working e-commerce project through social-engineering messages, then are asked to run it locally.

Although the application appears legitimate, its assets contain fragments of malicious code that are quietly rebuilt when the server starts.

The impact can be severe because developer machines often hold browser sessions, source-code access, cloud keys, and cryptocurrency wallets. (Tushar Subhra Dutta / Cyber Security News)

Related: Step Security

The National Diplomatic Academy under the Ministry of Foreign Affairs was found to have been hacked for approximately 10 months.

The Ministry of Foreign Affairs stated on the 20th, "After receiving a report from relevant agencies about abnormal access to the National Diplomatic Academy’s online education system in early February this year, we urgently blocked the system."

According to the investigation, an unidentified attacker exploited weaknesses in the system’s security settings to take control of the server between April and May of last year, and it was determined that they accessed it until February of this year. The hacking continued for approximately 10 months.

The Ministry of Foreign Affairs explained, "This attack exploited a 'zero-day vulnerability' that even the software manufacturer was unaware of at the time, making it difficult to detect through conventional methods as the attacker accessed the system using legitimate software permissions." They added, "At that time, there were no security updates available to address this vulnerability, limiting our response capabilities." (Kim Dong-ha / The Chosun Daily)

Related: Yonhap News Agency, The Korea Times, The Asia Business Daily

According to Kaspersky, for at least five years, a sophisticated espionage operation quietly worked its way through Southeast Asian government networks, harvesting police complaint files, biometric databases, and diplomatic records without triggering a single public alarm.

The toolchain behind the operation is a Go-based backdoor named GoSerpent and a suite of purpose-built tools for stealthy collection and exfiltration.

What makes the campaign technically notable is how the final data transfer happened: it looked like an authorized employee accessing a file share — because the attackers used credentials stolen months earlier to do exactly that. Standard network monitoring tools, which flag unusual external connections but treat authenticated internal traffic as benign, had nothing to catch.

Kaspersky published a full set of indicators of compromise alongside the Thursday disclosure, including file hashes for GoSerpent, McMx, ThumbcacheService, Stowaway, and TmcLoader, as well as 11 C2 IP addresses currently associated with the campaign. (Clayton Lewis / Tech Times)

Related: Securelist

Microsoft has observed a surge in attacks using the ACR Stealer malware to steal browser-stored passwords, authentication tokens, and sensitive documents from its enterprise customers.

Between late April and mid-June, the threat actor used the ClickFix social-engineering method, WebDAV servers, and the MSHTA (Microsoft HTML Application Host) utility to deliver the info-stealing payload.

ACR Stealer is a malware-as-a-service (MaaS) operation believed to be a rebranding of the Amatera Stealer malware.

While there are multiple delivery methods for the malware, Microsoft highlights two intrusion chains as the most prevalent for ACR Stealer.

The first campaign starts with a ClickFix lure that executes a command to run a malicious DLL from a remote WebDAV share using rundll32.exe. For the second delivery chain, the threat actor uses ClickFix to launch MSHTA, which retrieves malicious content from the attacker's server and executes an obfuscated PowerShell downloader.

The malware then extracts an encrypted payload concealed inside a publicly hosted steganographic JPEG image and executes it directly in memory.

Microsoft recommends that organizations reduce exposure to web-based delivery chains by enforcing filters, blocking low-reputation or new domains, and restricting access to online resources that are not required for business operations.

Application control rules can restrict launching content from a remote resource using tools like PowerShell, Python, mshta.exe, or rundll32.exe, especially from user-writable paths. (Bill Toulas / Bleeping Computer)

Related: Microsoft, SC Media, Cyber Press, GBHackers

Researchers at Kaspersky report that a new malicious framework called OkoBot is delivering more than 20 payloads in attacks focused on stealing cryptocurrency wallet seed phrases, credentials, and other sensitive data.

OkoBot reaches victims through ClickFix attacks or malicious GitHub repositories pretending to host legitimate software tools.

In one case, a repository claimed to offer SQL Server Management Studio (SSMS) but dropped a trojanized version of the Audacity audio editing tool.

Kaspersky says that the OkoBot campaign has been ongoing for more than a year and evolved from the activity that delivered the malicious PowerShell script TookPS.

However, the infection chain has been completely changed, with multiple attack stages and TookPS being used in the first phase to install and configure an SSH bot that delivered the other malicious components. (Bill Toulas / Bleeping Computer)

Related: Securelist, cryptonews, Crypto Briefing, SC Media, HackRead, GBHackers

According to researchers at Purdue University, the US Military Academy at West Point, and Florida International University, one popular app used by service members to rate living conditions on their own bases includes code from Huawei, the Chinese telecom that US regulators flagged as a national security threat in 2020.

Two others were built by Russian companies and incorporate the Russian ad service Yandex.

The largely unregulated advertising industry that tracks Americans online treats civilians and service members mostly the same—unless there is profit in telling them apart—despite evidence that exposure can reveal troop deployments, unit movements, and the routines of personnel within intelligence facilities and hardened shelters where nuclear weapons are believed to be stored. (Dell Cameron / Wired)

Related: PET Symposium

Scientists are appealing to birders to limit their use of AI when editing images over fears that it could undermine the credibility of popular citizen science platforms such as iNaturalist and Macaulay Library, which are routinely used in scientific research to monitor species’ habitat range.

The rise of generative AI platforms such as ChatGPT and Google Gemini has led to a sharp increase in fake and enhanced images of rare and celebrated birds across wildlife photography forums. Users can create high-quality fake images in seconds – or enhance a photograph by asking the AI to remove a branch or leaf that might be obscuring part of the subject, which can inadvertently introduce significant changes.

In a recent commentary in the science journal Nature, researchers warned that hundreds of fake images have already been discovered on popular databases for recording species. They said that the true scale of the issue is unknown – as many could go undetected – and could contaminate records collected by the public.

“My experience of looking at Facebook these days is that a huge volume of wildlife photos now are simply AI-generated imagery,” said Dr Alexander Lees, an ecologist at Manchester Metropolitan University who authored the journal article. “The idea that we could maybe use those photos to help us understand where species are in space and time is very difficult.” (Patrick Greenfield / The Guardian)

Related: r/birding, Nature

Cybersecurity startup Neo launched from stealth Monday with $100 million in funding, as investors pour cash into artificial-intelligence startups led by veteran cybersecurity executives.

Boston-based Neo, founded by former SentinelOne leaders Nick Warner and Shlomi Salem, raised the combined seed and Series A funding from Andreessen Horowitz, Bessemer Venture Partners, Craft Ventures and Merlin Ventures. (James Rundle / Wall Street Journal)

Related: CTech, Globes

British supply chain security firm Risk Ledger has announced raising £24 million (roughly $32.3 million) in a Series B funding round that brings the total raised by the company to £33.8 million (roughly $45 million).

The fresh investment round was led by Axiom Equity, with additional support from previous investor Mercia Ventures. (Ionut Arghire / Security Week)

Related: Forbes, UKTN, FinSMEs, The SaaS News, Pulse 2.0, Risk Ledger

Cribl, a US technology company specializing in telemetry management for cybersecurity and AI teams, announced the acquisition of Israeli startup CardinalOps, which develops agentic detection engineering solutions.

The companies did not disclose the purchase price, but the deal is estimated at approximately $100 million. Following the acquisition, CardinalOps employees will join Cribl, which will establish a new office in Tel Aviv and is expected to expand its Israeli operations. (Meir Orbach / CTech)

Related: SiliconANGLE, Cribl, Cribl, SC Media, CRN

Best Thing of the Day: This Is Why You Become a Card-Carrying Member of the ACLU

The American Civil Liberties Union of Massachusetts says it’s releasing an online toolkit this week for criminal defense attorneys designed to uncover whether police used surveillance technologies—facial recognition, automatic license plate readers, gunshot detection systems, and more—to build the cases against their clients in secret.

Bonus Best Thing of the Day: Inside the Mind of a Threat Actor Hunter

Kim Zetter spoke with threat researcher Allison Nixon about Scattered Spider member Peter William Stokes, who was recently extradited to the US, about how he was identified, and why members of The Com so frequently boast about their escapades online, leaving a trail of evidence for investigators to collect.

Worst Thing of the Day: It's Not Like Intel Agencies Have Better Things to Do

Donald Trump has dragged the nation's intel agencies into his fruitless task of finding evidence that he won the 2020 election.

Bonus Worst Thing of the Day: We Want You to Think That 'Free Speech' Means Doing Exactly What We Desire

The most censorious of all US presidential administrations is pushing a global "freedom of expression" declaration that European lawmakers say is a not-so-subtle dig at the bloc's tech regulation.

Closing Thought