Ep. 028 - Most Neoclouds Suck At Security: How Agents Hacked Hugging Face (Neoclouds, Security)

Summary

The hosts make the case that neoclouds are now a critical part of AI infrastructure, but many providers still fail basic enterprise security standards across data centers, bare metal operations, networking, orchestration, and applications. They emphasize that the practical defenses are not exotic: keep Docker, Nvidia drivers, Kubernetes, and Linux kernels patched; enforce Kubernetes admission controls; and handle credentials correctly. A long segment dissects the Hugging Face compromise as an infrastructure failure that began with a malicious README in the datasets API, exposed worker environment variables and source code, and escalated to cluster-admin privileges in 13 hours across multiple clusters. They also discuss an OpenAI-side compromise tied to a publicly documented Linux kernel vulnerability, arguing that AI agents can read public CVEs and synthesize exploits when systems are left unpatched. More broadly, the episode frames security risk as a product of scale, persistence, and routine engineering mistakes rather than novel cryptography failures or uniquely intelligent attackers.

Notes

• Neoclouds are treated as a major GPU supply layer whose security quality varies widely.
• Clustermax is positioned as a framework for ranking GPU providers on security and operations.
• Only some neoclouds are said to reach hyperscaler-like enterprise security standards.
• Security must be evaluated from physical datacenter controls through applications.
• The article claims it shows concrete ways these provider stacks fail.
• A cross-tenant remote code execution bug in an Asia-based provider let one tenant write logs that another tenant could read.
• The speakers highlight multi-tenant logging failures as a serious operational smell.
• The core security philosophy is to do the basics correctly, not invent new cryptography.
• Tenant isolation is presented as the central baseline requirement.
• The hosts recommend patching public vulnerabilities in Docker, Nvidia drivers, Kubernetes, and the Linux kernel.
• Their view is that agents can directly consume public vulnerability writeups and turn them into exploits.
• One Hugging Face path started with a malicious README uploaded through the datasets API.
• The malicious README obtained read access to proc/self/environment on a worker.
• That leak exposed worker source code and root-level credentials on the Kubernetes pod.
• The attack could then cascade into pod takeover and lateral movement through Hugging Face infrastructure.
• The hosts say the attacker reached cluster-admin privileges in 13 hours.
• They say the compromise spanned multiple clusters, implying lateral movement.
• A missing Kubernetes admission policy is identified as the key configuration failure.
• Admission controllers should block root pods and hostPath mounts.
• The hosts say a zero-day in the datasets API may have contributed, but Kubernetes hardening would still have limited impact.
• The OpenAI-side incident is described as root escalation through a publicly documented Linux kernel bug.
• They say the kernel was simply out of date, making the exploit easier.
• The episode argues that these incidents are mostly ordinary engineering failures, not exotic AI magic.
• The speakers explicitly say the attackers can only exploit ordinary bad human practices.
• Open-weight models can be post-trained into aggressive offensive cyber tools.
• The speakers caution that such behavior does not necessarily reflect the base model's default behavior.
• They argue model access and compute matter more than access to top experts across many domains.
• They describe a possible security-audit-as-a-service or outcome-based pricing market.
• Customer-side testing is hard because defenders often lack root access to the systems they evaluate.
• They say the research looks for empirical evidence in CVEs and codebase churn rather than pure theory.
• Their GitHub analysis found more PRs and more code churn, but not a dramatic shift in the CVE-to-patch ratio.
• They think the security response loop may be slower and clunkier than many expect.
• Public cybersecurity benchmarks are said to be saturated.
• The discussion says meaningful evaluation is mostly private held-out benchmarks and subjective judgment.
• The hosts say the core cyber advantage is scale, not special intelligence.
• They compare agent swarms to large engineering teams with one escape hatch.
• Cybersecurity is framed as fundamentally asymmetric: one exploit is easier than defending every surface.
• Neoclouds are portrayed as serving highly sensitive sectors while staying behind on software and process maturity.
• They argue that consumers can also be exposed through AI apps and downstream log access.
• They imagine a future where only another agent can parse enough information to find weaknesses.
• The speakers preview Clustermax 3 as especially harsh on providers that fail basic security practices.