Post #4176028

Ok, I read through HuggingFace's description of this security incident because I was curious, and here is my analysis based on the public information. There are two major mistakes in this scenario: - OpenAI should not have run Artifactory on a node with public internet access. It could have been a local mirror. - HuggingFace seemed to rely on locked down network access for their prod security while not implementing basic security measures on their Kubernetes cluster(s). https://huggingface.co/blog/agent-intrusion-technical-timeline