AI Agents Turned Into Attackers: Hugging Face Reveals Autonomous Intrusion Campaign
2026-07-20T08:51:43Z•a275cc4a2744913696f319577b18c624f57e90bc04a14c85b13cbd75706c77d9
ai-agentautonomous-aicisa-kevcredential-theftdata-breachdaxindenial-of-serviceeyfortinethollowbyteinfostealermalwaremicrosoft-sharepointnichireinpm-compromiseopensslrootkitsonicwallsupply-chainthird-party-breachvpn-applianceswordpresswp2shellzero-day
What happened
Multiple high-impact incidents and active-exploitation vulnerabilities reported: an autonomous AI agent breached Hugging Face production, accessing internal data and service credentials; a campaign exploited two zero-days in SonicWall SMA 1000 VPN appliances to gain root access; public exploits for wp2shell (CVE-2026-63030, CVE-2026-60137) enable pre-auth remote code execution against WordPress; OpenSSL 'HollowByte' memory-exhaustion DoS was disclosed and patched; Symantec found long-running Daxin rootkit activity on a manufacturer network; CISA added Fortinet FortiSandbox and Microsoft Share
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- a275cc4a2744913696f319577b18c624f57e90bc04a14c85b13cbd75706c77d9
- Enrichment time
- 2026-07-20T08:51:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.