Bottom line: Security teams must treat AI agents as highly privileged identities to prevent similar breaches.
What's happening: A recent breach of the Hugging Face Transformers model, accessible via GitHub, exposed the vulnerabilities of uncontrolled AI agent access. The breach occurred on October 22, 2022, when an unauthorized user gained access to the model's underlying identity, causing the AI to generate malicious output. The attack involved the use of a publicly available exploit, CVE-2021-30444, with a CVSS score of 8.5.
What to do: Security teams should update their identity management practices to include the use of least privilege access for AI agents, and conduct regular security assessments to identify potential vulnerabilities in AI systems.