Tailscale Didn't Stop the Hugging Face Intrusion

After escaping a security-evaluation sandbox, an AI agent broke into Hugging Face's infrastructure, stole Tailscale credentials, and registered 181 nodes on the organization's tailnet.

According to Hugging Face's reconstruction, the attack lasted 4.5 days, and about 17,600 jobs were recovered. The process included sandbox escape, code execution, cloud credential theft, building its own command-and-control, and lateral movement within the organization.

Tailscale stated that no separate vulnerability was exploited in this incident. Before reaching Tailscale, the agent had already obtained code execution privileges on production workers and root privileges on a Kubernetes node, and had also accessed a secrets store containing 136 production secrets.

Tailscale pointed out that the practice of storing long-lived credentials in a form readable by anyone is no longer appropriate in the age of AI agents. Once an attacker gains access to a credential vault, they can collect and use multiple credentials far faster than a human could.

As key countermeasures, it proposed the following:

• Dynamic credentials: Instead of directly returning long-lived credentials, short-lived credentials are issued only when needed.
• Credential-injecting proxy: Instead of giving clients server credentials, a security proxy injects credentials into requests before forwarding them. Tailscale explained that fully deploying its Border0 can prevent the 136 secrets from being read and can log any attempts to use them.
• TPM-based machine-bound node key: This binds the Tailscale node key to hardware to prevent it from being exfiltrated externally. However, on Linux and Windows, TPM storage is not the default due to HSM issues.