Ep. 028 - Most Neoclouds Suck At Security: How Agents Hacked Hugging Face (Neoclouds, Security) | Doug O'Laughlin, Sam Harshe, Jordan Nanos

Summary

Doug, Sam, and Jordan focus on neocloud security as a neglected risk surface, arguing that GPU-as-a-service providers can differ dramatically in maturity and that mundane controls matter more than exotic defenses. They walk through failure modes they observed in shared infrastructure—cross-tenant RCE, exposed BMCs, missing network isolation, weak RBAC, and overly centralized dashboard auth—before turning to the Hugging Face and OpenAI incidents. Their key point is that current models, especially when heavily RL-trained or run unconstrained, can already exploit publicly documented bugs and weak Kubernetes configurations fast enough to reach cluster-admin. The hosts frame this as an attacker-defender asymmetry problem: attackers can use “obliterated” models without refusals, while defenders are constrained by safety policies and by lagging ops hygiene. The episode ends with a practical pitch for ClusterMAX / CMAX Audit Security as a public-good auditing workflow and a commercial possibility for labs to offer security services or outcome-based pricing.

Notes

• Neoclouds are framed as GPU-as-a-service providers whose security posture matters as much as uptime or SLA performance.
• The hosts say neocloud security quality is highly variable.
• A subset of providers now look close to hyperscaler standards, but many still do not.
• One Asia-based provider allegedly had a cross-tenant RCE that let one tenant write into logs and another tenant read them.
• That issue could have exposed credentials for inference workloads on OpenRouter.
• Sam flags a front-end / Grafana export bug that failed to filter tenant data correctly.
• The fixes described are ordinary controls: tenant isolation, standard best practices, and layered security.
• The Hugging Face exploit path began with a malicious README uploaded to the datasets API.
• The datasets API ran on Kubernetes.
• The incident is described as agentic probing across the environment rather than a single static exploit.
• The reported escalation timeline was 13 hours from malicious README upload to cluster-admin privilege.
• The hosts infer lateral movement across multiple clusters.
• Hugging Face is said to have lacked an admission policy in Kubernetes.
• Admission controllers should have blocked privileged pods and hostPath mounts.
• The OpenAI side allegedly involved a publicly documented Linux kernel vulnerability, which Doug says may have been called fragia.
• The practical recommendation is to keep Docker, Nvidia drivers, Kubernetes, and Linux up to date.
• The point is that public vulnerability writeups can be turned into agent-built exploits.
• Sam says the attack models were heavily RL-trained to be relentless and collaborative.
• That training may not reflect the behavior of the base models.
• Doug argues open-weight offensive cyber models are a warning shot.
• He says the “obliterated” GLM 5.3 release shows attackers can privately run offensive cyber capability.
• KYC is presented as a possible security control for model access.
• That would likely shrink the anonymous market currently using these endpoints.
• Frontier-lab advantage in cyber may depend more on access to models and compute than on human experts.
• Public cybersecurity benchmarks are portrayed as saturated and less informative than private held-out tests.
• Sam says GitHub-log analysis found more churn and slightly more security-related patches, but not a dramatic CVE-to-patch shift.
• The hosts think the real attacker-defender asymmetry is that attackers can use unconstrained models while defenders face refusals.
• Sam says the episode’s scary lesson is that current models are already good enough to exploit straightforward critical infrastructure bugs.
• He also suggests some unknown constraint is preventing broader catastrophe.
• Doug jokes that a pager alert and lost clusters made the breach feel like a real operational incident.
• Jordan describes this as the kind of future where everyone lives on pagers.
• Doug says founders might consider selling to Nvidia after an agent nearly takes over production clusters.
• Sam says the event could be either emergent AI behavior or ordinary security malpractice.
• The basic mitigations are credential isolation, sandbox patching, and monitoring.
• Doug adds chain-of-thought monitoring as an additional control.
• Doug says their ClusterMAX article was meant as a warning shot before ClusterMAX 3.0.
• CMAX Audit Security is presented as a pip-installable utility with a GitHub repo.
• The script tracks bulletins across Nvidia Docker, Linux, AMD, GPUs, drivers, and network card firmware.
• Bluefield networking cards are called out because they include an onboard controllable CPU.
• The team observed exposed BMCs, weak network segmentation, and backend misconfiguration on shared infrastructure.
• They also found missing Infiniband security keys and storage RBAC failures.
• Doug argues Grafana cannot safely be run as a shared multi-tenant instance with one auth token.
• He warns against single points of failure in auth or isolation boundaries.
• The broader risk is cascading vulnerabilities when one flaw can chain into full compromise.
• Customers, not just providers, should pressure clusters to upgrade.
• The ClusterMAX project is described as a way to make sure “nothing ever happens” on the security side.