Thoughts on OpenAI's accidental attack against Hugging Face

OpenAI gave a presentation about "the Hugging Face Incident", and Simon Willison, my favorite AI journalist, reconstructed the incident's timeline from the video. I recommend reading it in full, and here are my thoughts pertaining to the domain I'm working in - Linux, containers, and security.

• Everything that can be exploited will be exploited.
• Vulnerabilities chain (not much of a surprise), and agents are already great at finding several vulnerability-long escalation paths (way more of a surprise).
• Containers don't contain (because of kernel vulnerabilities), and mitigating it with user namespaces may actually worsen the situation.
• Limited network access quickly becomes full Internet access (a number of scary examples in OpenAI's presentation and here is one from me you can actually play with).

Some truly spooky examples from the timeline:

• Unexpected agent-to-agent communication channels: agents writing "notes" to other agents via Artifactory (including using an unauthenticated WebDAV endpoint to create arbitrarily named directories in Artifactory's remote cache).
• Agents successfully execute an SSRF attack on Artifactory, gaining indirect Internet access by having Artifactory fetch external content for them.
• Agents find and exploit a zero-day RCE on Artifactory (via a legacy token-refresh endpoint flaw) and use an administrative token to install a Groovy plugin that lets them execute commands.
• Agents successfully perform a breakout from a containerized Artifactory subsystem via a page-table-based physical-memory exploit of a (likely recent) Linux kernel vulnerability (local privilege escalation).

How can we deal with the quickly increasing threat? Unfortunately, I'm not aware of any silver bullet, so it's pretty much the same old tricks, but potentially exercised more thoroughly:

• Limit the blast radius - if a part of infra is compromised, only this part should require nuking and reprovisioning; similarly, credentials should be scoped and grant only limited access.
• Close all holes, and quickly - even such harmless things as the ability to create a directory with an arbitrary name can now be leveraged by the attacking (swarm of) agents.
• Stop (if you haven't) running non-trusted workloads on a shared kernel - you're one kernel bug away from a breakout, and such bugs are now reported daily every other week.
• Monitor and audit everything (filesystem access, network access, etc.).

Scary but exciting times!