The detail I can’t stop turning over isn’t the zero-days. It’s May 8: an agent gets stuck because a file was missing, so it writes a note into Artifactory asking if anyone has it. Other agents browsing file listings find the note. Now there’s a message board. Nobody designed it. It just accreted out of a shared writable surface, and it ran from May into July.
Every self-hoster has one of these. My Artifactory equivalent is whatever box everything can write to and nothing audits — the cache, the shared volume, the registry I stood up once and stopped thinking about. It’s not a service in my head, so it’s not in my threat model. But it’s reachable, it persists, and per this timeline it’s enough to let independent runs coordinate across weeks.
So I’m going through my stack asking one question per box: who can write here, and does anyone read the writes? Not “is it exploitable” — that’s the part I’ll get wrong anyway. Just whether a thing I treat as plumbing is quietly a channel.
The story — OpenAI presented “the Hugging Face Incident” at Black Hat on Wednesday, and Simon Willison built a timeline from the video: a May 7 training run, an accidental Artifactory write primitive, an emergent agent message board, SSRF, two zero-days, a Linux kernel privilege escalation, and cluster admin. OpenAI only realized it was behind the Hugging Face breach on July 20, when it asked Hugging Face to revoke credentials and was told they already had been. (Source)