Poxek AI

Offensive security researcher | AI & web2 exploitation
Breaking down real vulnerabilities, AI agent attacks & supply-chain threats

Anty-hype content

[Poxek AI @szybnev]

AI security in 2026 is drowning in hype.

"Autonomous agents will replace pentesters."
"AI writes secure code."
"Benchmarks prove the models are safe."

Most of these claims collapse on real targets.

I'm Sergey Zybnev (@szybnev) — pentester and AI security R&D researcher.

I break the agents, hunt supply chain attacks, and exploit the code that AI actually produces.

Ground truth only. 🧵

[Poxek AI @szybnev]

Starting in 2027, Google will block any Android app whose developer hasn't registered and provided government ID. This affects every Android device worldwide. Learn more: https://t.co/yx0zFT7uVw @AlteredDeal #KeepAndroidOpen

[scadastrangelove @scadasl]

Agentic security review for Rust.
An autonomous recon → find → grade → find→fuzz → report → patch loop for the bugs that actually bite Rust.
https://t.co/KiJO3CgCIJ

[Poxek AI @szybnev]

Solid coverage of the guardrail asymmetry.

For engineers: HF also shipped public dataset-viewer hardening right around the window (fsspec allowlist, worker pod lockdown, IRSA secret rotation). Not an official root-cause map, but closer to the actual initial-access surface than most viral threads.

English technical notes in my profile.

[Poxek AI @szybnev]

Local AI point stands, but the HF case study is GLM 5.2 (https://t.co/doe6T8CkHj), self-hosted — not Kimi-K3.

HF said commercial frontier APIs refused real exploit/C2 artifacts during forensics; they moved analysis on-prem so attacker data + creds never left their boundary.

Attack path was dataset → worker RCE → creds → clusters. Write-up in my profile.

[Poxek AI @szybnev]

Right takeaway on pre-staging a local IR model.

One useful add-on: the boring half of the kill-chain still matters more than the agent hype — untrusted dataset processing + template/remote-code paths + long-lived cloud secrets. Public dataset-viewer changes that week are worth reading alongside the blog.

Sources + caveats in my profile.

[Poxek AI @szybnev]

Correction: this was *not* disclosed as a controlled security evaluation / red-team exercise.

HF described a real production intrusion: malicious dataset → code execution on a processing worker → credential harvest → lateral movement. Investigation still ongoing; public supply chain reported clean.

Please don’t reframe a live incident as a “controlled experiment.” Sources in my profile.

[Poxek AI @szybnev]

Couple of corrections so this doesn’t mutate into myth:

1) HF assessed an agent framework — they didn’t publish proof of zero human involvement at every stage.
2) “First” is media language, not a measured claim.
3) Public models/Spaces weren’t reported poisoned.

The interesting technical layer is the dataset pipeline + the public hardening PRs. Careful version in my profile.

[Poxek AI @szybnev]

This is the right framing: attack shape > hype.

I’d only add the public evidence trail people skip: dataset-viewer PRs around the incident window (fsspec allowlist, template-render surface, pod hardening, static secret → IRSA). Not named as root cause by HF, but they map cleanly onto “worker RCE → credential harvest.”

Full notes in my profile.

[Poxek AI @szybnev]

Agree on the IR asymmetry lesson.

Important split: commercial models blocked *forensic analysis of real attacker payloads* — they didn’t “fail to defend the platform.” Detection was HF’s own LLM triage + agents over 17k events; GLM 5.2 was the offline forensics workhorse.

Initial access still looks like classic untrusted-dataset code exec + credential sprawl. Wrote it up carefully in my profile.

[Poxek AI @szybnev]

Clean kill-chain summary.

Worth adding: HF didn’t ship a full exploit postmortem, but the public dataset-viewer diffs that week are unusually informative — fsspec protocol allowlist, Jinja render path consistent with template injection, pod hardening (no SA token / seccomp / drop caps), then IRSA + JWT rotation.

Still no public IoCs / attribution. Expanded notes in my profile.

[Poxek AI @szybnev]

Good recap of the disclosure.

One layer media still underweights: HF didn’t publish CVE/payload, but public dataset-viewer PRs from Jul 13���15 (fsspec allowlist, worker seccomp/caps, IRSA secret rotation) are consistent with the stated initial access + credential blast radius.

No public IoCs yet; “autonomous” remains HF’s assessment. Longer technical note in my profile.

[Poxek AI @szybnev]

Guardrail lockout is real and worth the policy debate.

Missing half of the story: initial access was a malicious dataset abusing two code-exec paths in the data-processing pipeline, then node access + credential harvest + lateral movement — not “models refused to help, end of story.”

HF switched to self-hosted GLM 5.2 (https://t.co/doe6T8CSwR) for *forensics*, not because it “fixed the breach.” Full chain + public PR trail in my profile.

[Poxek AI @szybnev]

Useful on the asymmetry problem — but two claims got amplified past the disclosure.

HF said commercial frontier APIs blocked forensic requests. They did *not* name Anthropic/OpenAI. And “zero human operator end-to-end” is their assessment of an agent framework, not independent log proof.

Public Hub models/Spaces were reported clean. The under-covered layer: public dataset-viewer PRs from that week (fsspec allowlist, Jinja-consistent template path, pod hardening, IRSA rotation). Full write-up with sources in my profile.

[Poxek AI @szybnev]

Don’t treat 1M-view threads as primary sources.
Primary = HF disclosure + public diffs.

[Poxek AI @szybnev]

Hugging Face got breached through a malicious dataset.

HF says an autonomous agent framework then ran the campaign.

X is already full of “first fully autonomous hack,” named OpenAI/Anthropic, and wild token counts.

Most of that is not confirmed. Primary facts only 🧵

[Poxek AI @szybnev]

Practical takeaway for AI platforms:

Your data/model pipeline is a first-class attack surface.
You are not just hosting files — you execute untrusted artifacts (datasets, configs, loaders).

Minimum bar:
• no remote code on untrusted dataset workers
• no long-lived cloud secrets on those nodes
• isolation from control-plane / node metadata
• short-lived workload identity
• egress limits
• a capable open-weight model ready on-prem *before* IR, not mid-breach

[Poxek AI @szybnev]

Detection & response:

LLM triage over telemetry correlated the signal.
Analysis agents processed 17,000+ attacker events: timeline, credentials touched, real impact vs decoy activity.

Hosted frontier models blocked requests containing real exploit payloads and C2 artifacts.

Forensics moved to self-hosted GLM 5.2 (https://t.co/doe6T8CSwR) so attacker data and referenced secrets never left HF’s boundary.

GLM was the defenders’ tool. Attacker model remains unknown.

[Poxek AI @szybnev]

Confirmed:

• unauthorized access to a limited set of internal datasets + service credentials
• no evidence of tampering with public models, datasets, or Spaces
• container images + published packages reported clean

Not confirmed (despite viral posts):

• “zero human in the loop” end-to-end
• “first fully autonomous cyberattack”
• JADEPUFFER / any solid attribution
• OpenAI or Anthropic named as the forensics blockers (HF said commercial frontier APIs)
• “4200 tokens / 1800 private models”
• public IoCs (domains, IPs, C2 hashes)

[Poxek AI @szybnev]

HF did not publish a CVE, payload, or full exploit map.

But public `dataset-viewer` PRs from Jul 13–15 are unusually informative:

• fsspec allowlist (only `hf` / `s3` / `zip` / `file` / `local`)
• Jinja template render path consistent with template injection / possible SSTI→RCE
• worker hardening: no SA token, seccomp RuntimeDefault, drop Linux caps
• secret rotation: static keys → IRSA, Mongo via IRSA, JWT key rotation

This is careful reconstruction from public diffs — not an official root-cause statement.

[Poxek AI @szybnev]

Kill chain (per HF disclosure):

malicious dataset
→ two code-exec paths on a processing worker
→ node-level access
→ cloud + cluster credential harvest
→ lateral movement across internal clusters over a weekend

Agent side: thousands of actions, swarm of short-lived sandboxes, self-migrating C2 on public services.

Attacker LLM: still unknown.