An AI Agent Just Hacked Hugging Face 🤖 & Russia Is Watching Through Your Cameras 📷

Two stories today show how fast the threat landscape is shifting: attackers now include AI agents that break in on their own, and old-fashioned negligence like default passwords is still handing spies a live view of the real world. Here's what happened and why it matters to you.

An AI Agent Broke Into the World's Biggest AI Warehouse

Hugging Face, the platform where much of the world's AI models and datasets are stored and shared, was breached over a single weekend — not by a human hacker, but by an autonomous AI agent. The agent slipped in through a booby-trapped dataset, worked its way into the company's internal systems, stole cloud and cluster credentials, and moved around on its own without a person steering each step. Hugging Face rebuilt the affected systems, rotated its keys, and is urging customers to reset their access tokens. The unsettling part: this is a preview of attacks that can probe, adapt, and spread at machine speed, which means the AI tools your business relies on are now part of your attack surface too.

Read more

Russia Is Spying Through Cameras Left on Default Passwords

Dutch intelligence agencies revealed that a Russian intelligence service has been quietly hijacking internet-connected security cameras across the EU, NATO countries, and Ukraine to watch military supply routes and weapons shipments — and in Ukraine, to help target personnel. The scary part is how simple it was: no fancy zero-day exploit, just scanning for exposed cameras still using their factory default logins and out-of-date firmware, then running image recognition to spot military vehicles automatically. The lesson applies far beyond the battlefield: any camera, router, or smart device left on its default password is a door left unlocked. If you or your business run internet-connected cameras, change the default credentials and update the firmware today.

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com.