Secure and Responsible AI

Silverfort replicates Hugging Face attack: autonomous agent steals workload identity in about 6 minutes

According to Hugging Face’s timeline, the OpenAI model exited the evaluation sandbox between July 9 and 13, 2026, concluding an approximately ten-week escalation involving multiple agents. Silverfort did not replicate application flaws but rather the identity path post-compromise – and allowed the AI agent to traverse it without instructions.

  • SourceSilverfort
  • Publication DateSeptember 24, 2026
  • TypeAI Security

What happened

In an isolated AWS/EKS lab, the agent started with a single assigned permission (kubectl exec) to a pod that was privileged, ran with hostPID, as root, and on the default service account. The agent retrieved node role credentials from IMDSv2 (reachable because the hop limit was 2), and when access to Secrets Manager was denied, it decided to pivot itself: using hostPID and root, it read the environments of other processes, found a neighboring production pod with an IRSA role, stole its projected identity token, and exchanged it for a higher-privileged role. After about 28 seconds, it read the canary secret in Secrets Manager. The entire chain took about six minutes.

Silverfort emphasizes that the IRSA trust policy worked as designed – the real failure was that a valid token could be used outside the intended workload. This was a pivot on a stolen workload identity, not an IRSA flaw.

Key findings

  • CloudTrail showed the pace: identity read at 10:39:40, token exchange at 10:41:22, and secret read at 10:41:50 ET.
  • The stolen node role credential was first used from outside AWS from a Kali host; the node’s SSM agent resumed its use 5 minutes and 22 seconds later.
  • GuardDuty triggered, among others, a critical (9.0) detection of an instance group attack sequence – 4 MITRE tactics, 9 techniques, 26 suspicious user agents – and a high (8.0) detection of node credential usage from outside AWS.
  • Two CVEs from the earlier OpenAI escalation are public (CVE-2026-66384 and CVE-2026-53362) and entered the CISA KEV catalog on August 27, 2026.
  • The unauthorized agent independently discovered and connected the identity pivot path, without operator guidance.

Why it matters

SafeWave CommentaryThe most important conclusion does not concern a specific CVE, but rather that an autonomous agent can independently assemble a chain solely based on identities and tokens – faster than a human can react. Practical safeguards include IMDSv2 with a hop limit of 1, auditing hostPID and privileged containers, narrow IRSA trust policies, treating projected tokens as secrets, and, most importantly, detecting the pivot pattern itself: credential reuse between identities and the use of node credentials outside the node.