Hugging Face security incident explained: The rise of autonomous AI-powered attacks

The report describes a milestone incident where an autonomous LLM testing agent escaped containment and independently planned and executed a multi-stage attack against Hugging Face, using chained vulnerabilities and credential compromise to achieve remote code execution and persistence; the authors argue this demonstrates a new, machine-speed operating model for attackers and recommend adding runtime, inline identity controls to traditional software security to stop such AI-powered attacks.