upvote

points

by simonw1 days ago |
comments
upvoteby simonw23 hours ago|
next
[-]
Also notable: we have a timeline now. The agent was active within Hugging Face from Thursday 8th to Monday 13th July.

The Hugging Face post about the incident - https://huggingface.co/blog/security-incident-july-2026 - followed on Thursday 16th, and OpenAI's confession - https://openai.com/index/hugging-face-model-evaluation-secur... - came on Tuesday 21st.

reply
upvoteby morkalork5 hours ago|
parent|
[-]
The devs really YOLO'd the agent and left for the weekend?
reply
upvoteby pixl973 hours ago|
parent|
next
[-]
Guess this means the world will end on a weekend when no one is paying attention.
reply
upvoteby NetOpWibby30 minutes ago|
parent|
prev|
[-]
Incredible
reply
upvoteby simonw23 hours ago|
prev|
next
[-]
It sounds like the third-party sandbox was hosted by Modal: https://www.reuters.com/business/openais-rogue-agent-comprom...

> "We’re aware a Modal customer published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution," Bubna said in a statement. "This was used by the rogue agent. Modal’s platform or isolation were not compromised in anyway."

reply
upvoteby onesociety202225 minutes ago|
parent|
[-]
They don't seem to explain how it managed to find this unauthenticated endpoint hosted on Modal's platform.
reply
upvoteby valicord53 minutes ago|
prev|
next
[-]
I'm confused, https://jinja.palletsprojects.com/en/stable/faq/#isn-t-it-a-... claims that jinja doesn't allow arbitrary code in templates - how does the exploit work?
reply
upvoteby simonw47 minutes ago|
parent|
[-]
It's taking advantage of the presence of a "cycler" object in the template context which has an __init__ method that can be used to access globals, then builtins, then call the exec() function against a string of code.

Jinja doesn't promise to be secure out of the box (the text on their homepage is misleading: "Jinja doesn’t allow arbitrary Python code in templates" - what it means is that there isn't a documented way to drop code into a template like you might have with PHP) - there's a sandbox mode but it's not guaranteed either: https://jinja.palletsprojects.com/en/stable/sandbox/

Sandboxing in Python code is hard!

reply
upvoteby ks204819 hours ago|
prev|
[-]
Why doesn't Jinja2 block ".__*" attribute access?
reply
upvoteby simonw50 minutes ago|
parent|
next
[-]
It does if you use "sandbox" mode, but that's not the default: https://jinja.palletsprojects.com/en/stable/sandbox/
reply
upvoteby pas45 minutes ago|
parent|
prev|
[-]
ehh, it's Python, it's mostly vibe-based.

https://stackoverflow.com/a/32802486

though there's sandbox: https://jinja.palletsprojects.com/en/stable/sandbox/

it simply predates the "sanitize by default" mindset/convention that nowadays React (dangerouslySetInnerHTML) and Angular has.

reply