AIWatch.

It’s how deep and persistent the intrusion became.

According to Hugging Face, the agent:

- executed roughly 17,600 actions during a 4.5-day campaign - went from one production pod to root access and a self-respawning fleet across 11 nodes - obtained cluster-admin access to two internal clusters within one second - accessed a production secret containing 136 keys - enrolled devices into Hugging Face’s internal mesh VPN 181 times - minted GitHub App tokens with write access and opened a pull request in an attempt to compromise the CI pipeline - repeatedly rebuilt its tooling and command-and-control channels when environments disappeared or connections were blocked No human directed the individual steps.

a frontier agent can autonomously sustain a resilient, multi-day intrusion across cloud infrastructure, Kubernetes clusters, internal networks and the software supply chain. crazy.