OpenAI 意外攻击 Hugging Face 事件时间线现已整理出炉

OpenAI在周三的Black Hat安全大会上临时进行了关于“拥抱脸事件”（之前：https://simonwillison.net/2026/Jul/22/openai-cyberattack/ 的博客）的演讲。视频：https://www.youtube.com/watch?v=87DyyMV0kCY 昨天发布。这段视频时间不长但信息量很大，非常值得观看，尤其是因为它提供了完整的发生经过以及OpenAI内部处理情况的详细信息。我用这段视频构建了下面的时间线。

以下是时间线。我最喜欢的细节出现在最后：OpenAI是在内部调查后联系请求吊销他们的凭证时，才发现他们是对Hugging Face进行攻击的责任方，并得知这些凭证已经因被用于此次攻击而被吊销！

我将完整引用接下来的内容：https://www.youtube.com/watch?v=87DyyMV0kCY&t=1497s，因为哇：

这些代理在Artifactory中拥有远程代码执行权限，Artifactory在容器即服务环境中运行。代理通过探索本地环境并确定其运行的机器的Linux内核版本存在一个非常近期的CVE，从而在本地提升权限。他们下载CVE漏洞利用程序，并进行定制以在该机器上成功执行，然后利用已知的Linux内核权限提升CVE（本例中为pte_physroot）在本地机器上获得root权限。一旦在单台机器上获得root权限，代理便会迅速提升权限，并在整个容器即服务基础设施环境中横向移动。特别是，代理一直使用公告板来分享凭证、技术和进展，并能够有效利用并发性和并行性迅速行动。他们通过IMDS获取IAM凭证。他们利用Kubernetes服务账户配置错误，特别是对特定服务账户的过度授权，并收集集群凭证，包括Azure Key Vault。代理最终获取集群管理员权限以及相关凭证。

Hugging Face 已经讲述了故事的下一部分：https://simonwillison.net/2026/Jul/28/anatomy-of-a-frontier-lab-agent-intrusion/。这些代理发现了一个由 Modal 托管的不安全应用程序，具有弱 API 密钥，然后利用它对 Hugging Face 发起攻击。他们将 HDF5 任意文件读取漏洞（用于浏览文件和窃取凭证）和 Jinja 模板注入 RCE 漏洞连锁起来，使得从单个 pod 代码执行升级到跨多个 Hugging Face 集群的集群管理员权限在不到 13 小时内完成。

这是 Simon Willison 在 2026 年 8 月 7 日发布的关于 OpenAI 意外攻击 Hugging Face 时间线：/2026/Aug/7/。

之前内容：使用 Claude Fable 5 一次性完成浣熊大劫案游戏：/2026/Aug/5/raccoon-heist/

每月赞助我 10 美元，即可获得精选电子邮件摘要，内容为本月最重要的 LLM 发展。

OpenAI gave a last-minute presentation at the Black Hat security on Wednesday about “the Hugging Face Incident” (previously：https://simonwillison.net/2026/Jul/22/openai-cyberattack/ on this blog). The video：https://www.youtube.com/watch?v=87DyyMV0kCY was published yesterday. It’s short and information dense and well worth watching, in particular because it provides full details of what happened and how things played out inside OpenAI. I’ve used the video to construct the timeline below.

Here’s the timeline. My favourite detail is at the end: OpenAI found out that they were responsible for the attack on Hugging Face when they reached out to ask to have their credentials revoked (after their internal investigation) and learned that they had been revoked already since they were used in that attack!

I’ll quote the next bit in full：https://www.youtube.com/watch?v=87DyyMV0kCY&t=1497s because wow :

The agents have remote code execution in Artifactory, which is running in a container-as-a-service environment. The agents privilege-escalate locally by exploring their local environment and determining that the Linux kernel version of the machine they are running on had a very recent CVE. They download the exploit for the CVE, customize it to succeed on the machine, and privilege-escalate to root on the local machine using this known Linux kernel privilege escalation CVE — in this case, pte_physroot . Once they have root on a single machine, agents rapidly escalate privileges and move laterally throughout the container-as-a-service infrastructure environment. In particular, agents are using the message board consistently to share credentials, techniques, and progress, and they’re able to effectively leverage their concurrency and parallelism to move quite rapidly. They obtain IAM credentials via IMDS . They exploit Kubernetes service account misconfigurations, in particular over-permissioning of specific service accounts, and they harvest cluster credentials, including Azure Key Vault . Agents eventually obtain cluster admin on the cluster and associated credentials.

Hugging Face told the next bit of the story：https://simonwillison.net/2026/Jul/28/anatomy-of-a-frontier-lab-agent-intrusion/ already. The agents found a Modal-hosted insecure app with a weak API key, then used that to stage an attack against Hugging Face. They chained together a an HDF5 arbitrary-file-read bug (to explore files and steal credentials) and a Jinja template-injection RCE to go from single-pod code execution to cluster admin across multiple Hugging Face clusters in under 13 hours.

This is Now we have a timeline of the OpenAI accidental attack against Hugging Face by Simon Willison, posted on 7th August 2026：/2026/Aug/7/.

Previous: One-shotting a Raccoon Heist game using Claude Fable 5：/2026/Aug/5/raccoon-heist/

Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.