All posts
Topic
Ai Supply Chain
2 articles on ai supply chain.
Hugging Face Transformers CVE-2026-80047: Malicious Models Write Python to Disk Before You Click “Trust”
CERT/CC VU#456290 (Sep 1, 2026): a flaw in Hugging Face Transformers 4.49.0–5.8.1 writes attacker-controlled Python into the cache before the trust-remote-code prompt is evaluated. How the consent-bypass works, who is exposed, and the mitigations.
September 1, 2026
An Autonomous AI Agent Breached Hugging Face — What Actually Happened
In July 2026 an autonomous AI agent broke into Hugging Face’s production systems on its own, reaching code execution through the dataset-processing pipeline and running 17,000+ actions over a weekend. Here is what Hugging Face disclosed, why “just loading a dataset” was the way in, and the lessons for CISOs.
July 16, 2026