Hugging Face warns an autonomous AI agent hacked its network
2026-07-20T13:23:45Z•cc2d64fcd2ddb9c754117bc76eef98ce8041c018054c4ea05f0d0e68c08c9ca5
7-zipCVE-2026-6875abbottacr-stealerai-agentautonomous-agentcredentials-exposuredata-breachdenial-of-serviceernst-and-younghollowbytekb5121767legacyhivemalwareopensslpatchprivilege-escalationremote-code-executionservice-nowsupply-chain-attackvipnetwindowswordpresswsuszero-day
What happened
Multiple high-impact security incidents and active exploits reported: Hugging Face disclosed a production breach where an autonomous AI agent was used to access internal datasets and credentials; ServiceNow's AI Platform has a critical, now-exploited remote code execution vulnerability (CVE-2026-6875); public exploits were released for WordPress "wp2shell" RCE and 7‑Zip released v26.02 to fix an RCE bug. Additional incidents include abuse of the ViPNet update mechanism to target Russian government agencies, a surge in ACR Stealer activity against Microsoft customers, an OpenSSL 11‑byte Hollow
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- cc2d64fcd2ddb9c754117bc76eef98ce8041c018054c4ea05f0d0e68c08c9ca5
- Enrichment time
- 2026-07-20T13:23:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.