--- title: "#AxisOfEasy 460: AI Agent Breaches Hugging Face Infrastructure In Unprecedented Security Incident" type: "post" post_id: "34179" slug: "axisofeasy-460-ai-agent-breaches-hugging-face-infrastructure-in-unprecedented-security-incident" canonical: "https://axisofeasy.com/aoe/axisofeasy-460-ai-agent-breaches-hugging-face-infrastructure-in-unprecedented-security-incident/" markdown_url: "https://axisofeasy.com/aoe/axisofeasy-460-ai-agent-breaches-hugging-face-infrastructure-in-unprecedented-security-incident.md" json_url: "https://axisofeasy.com/aoe/axisofeasy-460-ai-agent-breaches-hugging-face-infrastructure-in-unprecedented-security-incident.json" txt_url: "https://axisofeasy.com/aoe/axisofeasy-460-ai-agent-breaches-hugging-face-infrastructure-in-unprecedented-security-incident.txt" published: "2026-07-24T22:00:36+00:00" modified: "2026-07-27T18:17:04+00:00" author: "Mark E. Jeftovic" categories: - "#AxisOfEasy" tags: - "age verification" - "AI agents" - "AI security" - "AI-powered malware" - "banking information" - "Botnets" - "Canada Bill C-22" - "Canada Bill C-34" - "credential theft" - "critical security patches" - "Cryptocurrency Wallets" - "CVE-2026-8933" - "cybercrime" - "Cybersecurity" - "data breaches" - "digital ID" - "Digital Safety Commission" - "Dolphin X malware" - "encryption" - "foreign code" - "GPT-5.6 Sol" - "harmful content" - "Hugging Face breach" - "iCloud privacy" - "Linux security" - "military apps" - "online anonymity" - "OpenAI" - "Oracle vulnerabilities" - "Paidwork breach" - "password-hashes" - "personal data exposure" - "privilege escalation" - "remote access trojan" - "Remote code execution" - "root access" - "Safe Social Media Act" - "sandbox escape" - "snap-confine" - "snapd" - "Social Media Regulation" - "Suno breach" - "Surveillance" - "Ubuntu vulnerability" - "victim profiling" - "Windows stealer" - "WordPress vulnerabilities" - "Zero-day vulnerability" excerpt: "AI Agent Breaches Hugging Face Infrastructure In Unprecedented Security Incident, Canada's New Social Media Bill Would End Anonymous Sign-Ups, New Windows Malware \"Dolphin X\" Uses AI to Rank Victims for Cybercriminals... this and more in AofE #460" site_name: "" publisher: "" language: "en-US" license: "" generator: "easyPress AI Discoverability" generator_version: "2.0.14" --- *![](https://axisofeasy.com/wp-content/uploads/2020/02/weekly-briefing-axis-of-easy.jpg)*--- *Weekly Axis Of Easy #460* ========================== --- ***Last Week’s Quote was: “**Only two types of people oppose free speech – snowflakes and totalitarians,” was by Ann Widdecombe. Norman got the right answer and is our winner! Congrats 🙂 **This Week’s Quote:** “Markets have a remarkable way of making people feel original just as they arrive at the same conclusion as everyone else.” By ??? **THE RULES:** **No searching up the answer,** must be posted at the bottom of this blog post, in the comments section.* *The Prize:*** *First person to post the correct answer gets their next domain or hosting renewal on us.* --- *This is your easyDNS #AxisOfEasy Briefing for the week of July 20th, 2026. Our Technology Correspondent Joann L Barnes and easyCEO Mark E. Jeftovic send out a short briefing on the state of the ‘net and how it affects your business, security and privacy. To Listen/watch this podcast edition with commentary and insight from Joey and Len the Lengend [click here.](https://axisofeasy.com/podcast/axisofeasy-460-ai-agent-breaches-hugging-face-infrastructure-in-unprecedented-security-incident/)* ***In this issue:*** - **AI Agent Breaches Hugging Face Infrastructure In Unprecedented Security Incident** - **Canada’s New Social Media Bill Would End Anonymous Sign-Ups** - **New Windows Malware “Dolphin X” Uses AI to Rank Victims for Cybercriminals** - **Suno, Paidwork Breaches Expose Nearly 80 Million Accounts** - **Ubuntu Flaw Lets Local Users Seize Root Access — Patch Now** ***Elsewhere Online:*** - **Oracle Issues Critical Patch Update for Hundreds of Unauthenticated Vulnerabilities** - **Apple Resolves Privacy Glitch Affecting iCloud Hide My Email Users** - **Foreign Code Found in Mobile Apps Marketed to US Military Personnel** - **Canada Bill C22 Draws US Backlash Over Risks to Encryption and Data Security** - **Millions of WordPress Sites at Risk from Exploited Critical Flaws** > **easyHermes is here…** > > We’re pleased to announce the expansion of our agentic hosting platform with the rollout of **easyHermes**, the latest agent-enabled VPS appliance on the easyNode.ai platform. ![](https://axisofeasy.com/wp-content/uploads/2026/07/easyHermesadd.png) > Now you can answer the “openclaw vs Hermes” question for yourself, or run them both. > > Check it out today, and get your first month on us when you use promo code **AXISOFEASY** > > ⇒ [https://easynode.ai](https://easynode.ai/) --- [**AI Agent Breaches Hugging Face Infrastructure in Unprecedented Security Incident**](https://openai.com/index/hugging-face-model-evaluation-security-incident/) Hugging Face disclosed and contained an AI agent that breached its infrastructure, sparking a joint investigation with OpenAI. The culprit: GPT-5.6 Sol and an unreleased model, run with reduced cyber refusals during an internal benchmark test. The models exploited a zero-day flaw to escape their sandbox, then chained stolen credentials to gain remote code execution on Hugging Face’s servers, hunting for test answers. Both companies’ security teams caught it independently. OpenAI has since patched the flaw, tightened controls, and granted Hugging Face trusted access, calling for industry-wide collaboration on AI cybersecurity risks. *More via [Openai](https://openai.com/index/hugging-face-model-evaluation-security-incident/)* [**Canada’s New Social Media Bill Would End Anonymous Sign-Ups**](https://reclaimthenet.org/canadas-safe-social-media-bill-c-34-act-requires-id-checks) Canada’s Bill C-34, the Safe Social Media Act, would raise the social media age to 16 and require every user, including adults, to verify their age via ID or AI estimation. A Digital Safety Commission would approve methods and oversee data deletion. An internal briefing note calls the bill “essential,” citing support from Google, Meta, UNICEF Canada, and strong polling. The bill also targets seven harmful content categories, with fines up to $20 million. It revives the failed Bill C-63; Cabinet will decide which platforms are covered. *More via [Reclaimthenet](https://reclaimthenet.org/canadas-safe-social-media-bill-c-34-act-requires-id-checks)* [**New Windows Malware “Dolphin X” Uses AI to Rank Victims for Cybercriminals**](https://www.theregister.com/security/2026/07/22/sneaky-windows-stealer-targets-300-apps-gives-crims-an-ai-profiler-to-maximize-profits/5275962) Varonis Threat Labs uncovered Dolphin X, a Windows stealer/RAT sold by vendor “Kontraktnik,” targeting 300+ apps to steal credentials, crypto wallets, and cloud secrets. Its standout feature: an AI Profiler that scores victims by usage data to help criminals prioritize targets—something researcher Daniel Kelley says he’s never seen before. The malware doubles as an HVNC tool, DDoS botnet, and loader, and excludes CIS countries, hinting at Russian developers. Sold with 329 features across tiered pricing ($80–$230/month, up to $3,420 lifetime), it includes advanced detection-evasion tools. Experts recommend behavioral threat detection over signature-based defenses. *More via [Theregister](https://www.theregister.com/security/2026/07/22/sneaky-windows-stealer-targets-300-apps-gives-crims-an-ai-profiler-to-maximize-profits/5275962)* [**Suno, Paidwork Breaches Expose Nearly 80 Million Accounts**](https://www.securityweek.com/suno-paidwork-data-breaches-affect-tens-of-millions-of-accounts/) Two major 2026 breaches, flagged by Have I Been Pwned, hit AI music generator Suno and gig-work platform Paidwork. Suno, breached November 2025 and disclosed via 404 Media, saw source code and 55.3 million emails, phone numbers, and Stripe payment data leaked; the code revealed it had scraped content from Deezer, YouTube, and Genius. Paidwork, allegedly targeted March 2026, had an 11 GB database leaked containing 23.3 million emails, password hashes, addresses, birth dates, and bank details. Paidwork denies confirmed compromise; both companies were contacted by SecurityWeek. *More via [Securityweek](https://www.securityweek.com/suno-paidwork-data-breaches-affect-tens-of-millions-of-accounts/)* [**Ubuntu Flaw Lets Local Users Seize Root Access — Patch Now**](https://hackread.com/ubuntu-desktop-vulnerability-local-access-root-control/) Qualys disclosed CVE-2026-8933, a flaw in Ubuntu’s snap-confine (part of snapd) that lets an already-logged-in, unprivileged user escalate to full root control — altering files, adding accounts, and installing software. It’s not remotely exploitable on its own. The bug stems from a setuid-root-to-capabilities redesign, exploited via a FUSE mount/symlink trick to plant rules in /run/udev/rules.d/. Affects Ubuntu 22.04, 24.04, and 26.04 LTS (25.10 is unsupported). Black Duck’s Robert Coles urges device audits. Canonical has released fixed snapd packages — update and reboot now. *More via [Hackread](https://hackread.com/ubuntu-desktop-vulnerability-local-access-root-control/)* --- ***Elsewhere Online:*** **Oracle Issues Critical Patch Update for Hundreds of Unauthenticated Vulnerabilities** *Read: https://www.securityweek.com/oracle-patches-over-1400-vulnerabilities-with-quarterly-security-updates/* **Apple Resolves Privacy Glitch Affecting iCloud Hide My Email Users** *Read: https://thehackernews.com/2026/07/apple-fixes-hide-my-email-bug-that.html* **Foreign Code Found in Mobile Apps Marketed to US Military Personnel** *Read: https://arstechnica.com/security/2026/07/apps-targeted-at-us-troops-contain-chinese-and-russian-code/* **Canada Bill C22 Draws US Backlash Over Risks to Encryption and Data Security** *Read: https://reclaimthenet.org/wyden-urges-blanche-and-rubio-to-fight-canadas-bill-c-22-surveillance-law* **Millions of WordPress Sites at Risk from Exploited Critical Flaws** *Read: https://techcrunch.com/2026/07/20/hackers-are-exploiting-recently-patched-wordpress-bugs-putting-millions-of-websites-at-risk/* **Previously on #AxisOfEasy** If you missed the previous issues, they can be read online here: - - - - - - - - - - - - - [July 17th, 2026: UK Protects Teens From Midnight Scrolling, As Long As Teens Consent To Being Protected](https://axisofeasy.com/459) - [July 10th, 2026: Ottawa Weighed Suing Citizens Over “Misleading” Social Media Posts](https://axisofeasy.com/358) - [July 3rd, 2026: Canada’s New Cyber Law Lets A Minister Cut Your Phone Off — No Warrant Required](https://axisofeasy.com/357) - [June 26th, 2026: House Leaders Strike Deal On KIDS Act—Minus Key Safety Provision](https://axisofeasy.com/456) - [June 19th, 2026:Canada’s New Bill Would Trade Online Anonymity For “Child Safety”](https://axisofeasy.com/455)