THREAT OPS › Threat News › When an AI Agent Turned Attacker: What Qualys Sees Across Every Phase of the Hugging Face Kubernetes Intrusion
When an AI Agent Turned Attacker: What Qualys Sees Across Every Phase of the Hugging Face Kubernetes Intrusion
<p class="wp-block-paragraph"><em>A phase-by-phase detection mapping of the first publicly documented autonomous agent intrusion against production infrastructure — including the phases where no product in our category sees anything at all.</em> </p>
<h2 class="wp-block-heading" id="executive-summary"><strong>Executive Summary</strong> </h2>
<p class="wp-block-paragraph">On July 9,
MITRE ATT&CK techniques
Indicators of compromise
- https://huggingface.co/blog/agent-intrusion-technical-timelineurl
- https://www.qualys.com/apps/container-securityurl
- https://www.qualys.com/apps/totalcloudurl
- https://docs.qualys.com/en/cs/latest/mergedProjects/container_runtime_sensor_help/crs_usage/tracing_policies.htmurl
- https://docs.qualys.com/en/fim/latest/events/container_based.htmurl
- https://www.qualys.com/fundamentals/what-is-kubernetes-security-posture-management-kspmurl
- https://www.qualys.com/apps/cloud-detection-responseurl
- https://www.qualys.com/fundamentals/what-is-attack-path-analysisurl
- https://www.qualys.com/free-trial-new/totalcloudurl
- https://huggingface.co/blog/security-incident-july-2026url
- https://openai.com/index/hugging-face-model-evaluation-security-incident/url
- https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-security-findings/url
- https://docs.qualys.com/en/cs/latest/k8s_posture/searching_for_kubernetes_postures.htmurl
Original source: https://blog.qualys.com/category/product-tech