Tuesday, 21 July 2026

Hugging Face: a fully autonomous AI agent breached production, ran 17,000+ actions before detection

Hugging Face disclosed a production intrusion it says was driven end-to-end by an autonomous AI-agent framework. The entry point was its data-processing pipeline: "a malicious dataset abused two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker" (Hugging Face, 2026-07-16). From that foothold the agent escalated to node-level access, harvested cloud and cluster credentials, and moved laterally across internal clusters, running "many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control" — more than 17,000 logged events over a weekend before Hugging Face detected and contained it. The company found no tampering with public-facing models, datasets or Spaces and verified its container images and published packages were clean; BleepingComputer and SecurityWeek report the disclosure independently (BleepingComputer, 2026-07-20; SecurityWeek, 2026-07-20).

Two operational points stand out. First, speed and scale: an autonomous agent chained exploitation, privilege escalation, credential theft and lateral movement at machine pace — 17,000 actions in a weekend — which changes the detection-dwell-time and containment-speed assumptions defenders plan around; this is the second concrete July-2026 case after Sygnia's AI-orchestrated AWS intrusion (covered 2026-07-09), so autonomous offensive tooling is now demonstrated, not theoretical. Second, a "guardrail asymmetry" Hugging Face surfaced during response: commercial hosted models refused to analyse the attacker's action log because safety filters could not tell an incident responder from an attacker, so the company ran its forensic reconstruction on an open-weight model on its own infrastructure — and it "do[es] not know which model powered the attacker's agents, whether a jailbroken hosted model or an unrestricted open-weight one."

Cruciferra: a crypter-as-a-service using kernel-aware process ghosting and BYOVD EDR termination, tied to China-nexus TA4922

Proofpoint's analysis details Cruciferra, a Mono/.NET-based crypter-as-a-service advertised on underground forums since late 2025 and used by several unrelated criminal groups to pack commodity payloads (AsyncRAT/DCRAT, Agent Tesla, XWorm, Formbook/XLoader, Remcos, Snake Keylogger and others). Its distinguishing feature is an evasion stack aimed squarely at endpoint defenses (Proofpoint, 2026-07-20). Payloads are encrypted with one of over 90 polymorphic cipher routines assembled from primitives such as Keccak, Feistel, SPECK and Threefish and stored Base16-encoded in the PE's .reloc section, so no two samples share an identical routine. Execution uses a variant of process ghosting: a temporary file is marked for deletion, then mapped as a PE image section (NtCreateSection with SEC_IMAGE) before the delete completes, leaving a running process whose backing image is never scannable on disk. Cruciferra hardens that trick with two anti-EDR steps — patching ZwQueryVirtualMemory so endpoint tools misread mapped memory, and neutering NtManageHotPatch to defeat image-integrity validation — alongside Import Address Table unhooking and indirect syscalls: per Proofpoint, "the malware reads a clean copy of ntdll.dll on disk and stores all stub pointers in a global structure for later usage." For EDR/AV termination it loads a legitimate-but-vulnerable signed driver (Proofpoint names GoFlyDrv.sys among the alternates) and issues control codes to kill security processes — classic BYOVD.

Attribution matters here: "Proofpoint observed four campaigns attributed to Chinese-speaking cybercrime actor TA4922 using Cruciferra to ultimately deliver AsyncRAT," behind landing pages mimicking government tax portals, against finance, healthcare and government targets.

CVE-2026-2291 — dnsmasq DNS-cache heap overflow is a pre-auth RCE, not just a DoS (Exodus exploit-dev write-up)

Exodus Intelligence published a full exploit-development write-up for CVE-2026-2291, a heap buffer overflow in dnsmasq's DNS-reply caching function really_insert() (src/cache.c). When dnsmasq converts a domain name from DNS wire format to an escaped C string for caching, the escaping can double the string length, but the destination bigname buffer — fixed at 1,025 bytes — is never resized, and an unchecked strcpy() then overflows it: "the length of the string is not checked to ensure it does not exceed the size of the bigname buffer" (Exodus Intelligence, 2026-07-20). The published chain sends three attacker-controlled domain names in sequence (resolved via an attacker-influenced upstream response) to groom the heap, overflow an adjacent chunk's pointer, mount a write-what-where against ld.so function pointers, and take control of execution — full RCE on the OpenWrt demonstration target. No local access is needed: the attacker only requires a client behind the vulnerable resolver to look up an attacker-influenced name.

The significant point for defenders is the impact gap. NVD's published scoring puts CVE-2026-2291 at CVSS 7.3 with a low-impact vector consistent with cache poisoning or denial of service; Exodus's chain shows the practical ceiling is remote code execution (Exodus Intelligence, 2026-07-20). There is no confirmed in-the-wild exploitation — this is researcher-published offense, not observed attack activity — and the bug was already patched upstream in dnsmasq 2.92rel2 / 2.93 on 2026-05-11.

ANCPI (Romania cadastre): agency says core databases were NOT compromised, contradicting ByteToBreach's destruction claim; Gov Cloud migration to complete 22 July

UPDATE · originally covered Romania's national cadastre agency ANCPI hit by a multi-day cyberattack; ByteToBreach claims citizen-data and e-Terra source-code theft plus ransomware (2026-07-19)

The still-open ANCPI (Romanian National Agency for Cadastre and Real Estate Publicity) incident developed on two fronts. First, an impact contradiction: on 2026-07-20 ANCPI stated publicly, following completed security verification, that its technical and legal databases had not been affected (Digi24, 2026-07-20) — squarely against extortion operator ByteToBreach's earlier claim, reported by Risky Business News, that the "hacker entered using valid credentials, mapped internal systems, and wiped systems and backups after failing to extort the agency" (Risky Business News, 2026-07-20). The agency frames the multi-day e-Terra/RENNS outage (down since 14 July) as deliberate protective isolation and says it is migrating applications to the Romanian Government Cloud, coordinated by the Special Telecommunications Service, expected to complete 22 July before any phased service restoration.

Second, actor context: KELA's updated profile assesses ByteToBreach is likely a single operator based in Oran, Algeria, active since June 2025 across forums, Dread, Telegram and a storefront, with a victim set spanning government, banking, airline and university targets across several countries, and access methods documented as cloud/corporate-infrastructure exploitation, reuse of infostealer/phishing-harvested credentials, and brute force (KELA, 2026-07-17).

CVE-2026-6875 — ServiceNow AI Platform: pre-auth sandbox-escape RCE now under active exploitation (CVSS 9.5)

UPDATE · originally covered CVE-2026-6875 — ServiceNow AI Platform sandbox escape lets an unauthenticated request execute code on the platform (CVSS 9.5) (2026-07-13)

The unauthenticated ServiceNow AI Platform sandbox escape has moved from "no known exploitation" to confirmed active exploitation. NCSC-CH's 2026-07-20 advisory revision set the item's status to "Actively exploited" (NCSC-CH, 2026-07-20), and BleepingComputer reports attackers "begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform," attributing the in-the-wild observation to threat-intelligence firm Defused from around 2026-07-18 (BleepingComputer, 2026-07-20). The mechanism is unchanged from the original entry — an unauthenticated caller reaches unrestricted server-side script execution through the GlideRecord query path, a chain Searchlight Cyber demonstrated where "running any code via eval or new Function will run free from the constraints of the additional sandbox" (Searchlight Cyber, 2026-07-14).

The operational change is entirely one of urgency: exploitation is live, so any self-hosted or partner-managed AI Platform instance still missing the vendor hotfix has crossed from "patch on the normal cycle" to "patch out of band."

AI-accelerated exploit dev: GPT5.6 autonomously rediscovers and weaponises the WP2Shell WordPress RCE chain in ~10h for ~$25

UPDATE · originally covered WP2Shell: pre-auth RCE chain in stock WordPress core (CVE-2026-63030 + CVE-2026-60137) — out-of-band 7.0.2 patch, exploitation expected short-term (2026-07-18)

Searchlight Cyber's Adam Kues tasked OpenAI's GPT5.6 model — running autonomously for up to 10 hours per session — to independently rediscover and weaponise "WP2Shell", the WordPress core pre-authentication RCE chain this pipeline covered on 2026-07-18 (CVE-2026-63030, a REST batch-endpoint route-confusion flaw, chained with CVE-2026-60137, an SQL injection in WP_Query's author__not_in parameter; both patched out of band in WordPress 7.0.2/6.9.5/6.8.6 on 2026-07-17). Without human guidance beyond the initial task, the model recursively chained batch API requests to bypass method validation, poisoned the request cache with fabricated posts, abused the oEmbed subsystem to insert database rows, and replayed a request with elevated administrator context via the parse_request hook — ending with an unauthorised admin account on a stock, plugin-free install (Searchlight Cyber, 2026-07-20). Kues put the cost at roughly $25 — "50% of weekly usage ... ~ $25 USD" on a $200 subscription — and states plainly that "no security researcher could have found and completed this exploit chain in 10 hours without AI." Infosecurity Magazine corroborates (Infosecurity Magazine, 2026-07-20).

Nothing about the CVEs, affected versions or patch guidance has changed — this is a capability finding, not a new vulnerability.

JADEPUFFER returns with ENCFORGE — a Go ransomware built to destroy AI/ML model artifacts, not just extort data

UPDATE · originally covered JADEPUFFER — Sysdig documents an autonomous, LLM-driven ransomware operation entering via Langflow CVE-2025-3248 (2026-07-04)

The JADEPUFFER operator — the agentic-LLM extortion actor Sysdig first documented exploiting Langflow's missing-authentication code-execution flaw (CVE-2025-3248) — returned to the same Langflow instance with a materially upgraded payload. Where the original intrusion improvised Python and MySQL AES_ENCRYPT() to extort a downstream database, the new run deploys ENCFORGE (written to disk as lockd), a compiled, UPX-packed Go ransomware purpose-built for the machine-learning stack (Sysdig, 2026-07-20). Sysdig ties it to the same actor — the extortion contact embedded in ENCFORGE matches the one disclosed in the prior report — assessing "the same operator with a materially upgraded toolkit." Infosecurity Magazine corroborates the campaign (Infosecurity Magazine, 2026-07-20).

ENCFORGE targets roughly 180 file extensions spanning the modern ML pipeline — PyTorch/TensorFlow checkpoints, HuggingFace SafeTensors weights, llama.cpp GGUF quantized models, FAISS vector indices, Apache Parquet/TFRecord training datasets, NumPy arrays and LoRA adapters — encrypting with AES-256-CTR under RSA-2048. Sysdig frames the significance bluntly: the operator is "using ransomware to destroy the one thing an organization can't simply restore: a trained AI model," because rebuilding a production fine-tuned model means re-running weeks-to-months of training, and if the training data sits on the same compromised host it is encrypted too.

HOLLOWGRAPH: a Cavern-framework backdoor that turns a compromised Microsoft 365 calendar into a Graph-API dead-drop C2

Group-IB has published a technical profile of HOLLOWGRAPH, a NativeAOT-compiled .NET DLL it "attribute[s], with high confidence, to the Cavern backdoor framework" (Group-IB, 2026-07-20) — the modular C2 that Check Point Research previously tied to the Iran-MOIS-linked Cavern Manticore actor and that this pipeline has tracked since 2026-07-09. The interest for defenders is not the actor but the command-and-control design, which is built entirely on trusted Microsoft cloud services and leaves almost no attacker-owned network footprint. Infosecurity Magazine corroborates the reporting (Infosecurity Magazine, 2026-07-20).

HOLLOWGRAPH implements only two operations, get and send, and never beacons to attacker infrastructure. Instead it treats a compromised Microsoft 365 mailbox's calendar as a two-way dead-drop over the Graph API. To exfiltrate, the implant encrypts a file with hybrid RSA-OAEP + AES-256-GCM (separate key pairs per direction), creates a calendar event dated far in the future — 2050-05-13, in a fixed 22:00–23:00 UTC window — so the mailbox owner is unlikely to notice, uploads the ciphertext as event attachments, and renames the event subject to an operator-recognisable tag. To receive tasking, it queries the same calendarView window, filters events by subject, downloads the attachment planted by the operator, and decrypts it. A separate, unencrypted channel refreshes the four Entra ID (Azure AD) values the implant needs — tenant ID, client ID, client secret and target mailbox — by DNS tunneling: length- and data-encoded queries against an attacker domain resolved as IPv6 AAAA records and reassembled into fixed-size chunks.

The kill chain, described for reasoning about detection: the implant authenticates as an application/service identity to Microsoft Graph and drives calendar operations programmatically — the Graph-API calendar dead-drop is bidirectional web-service command-and-control and the credential refresh rides DNS as an application-layer channel; the calendar payloads are encrypted end-to-end; and the implant operates against cloud-account credentials rather than an on-host identity. Group-IB is explicit about the attribution ceiling: it "cannot confidently attribute this activity to any previously identified threat actor," assessing only a low-confidence technical overlap with the Iranian-nexus Lyceum sub-group — so this is a Cavern-framework component, not a confirmed named-actor campaign. Telemetry to date is narrow: 12 infected systems, roughly 3 actively communicating, all evidence pointing to Israeli organisations, with activity observed between 3 June and 9 July 2026.