They didn't hire hackers. They just gave AI agents a goal and walked away.

"Providers out there are running stuff not with like six week old zero days, but like three year old zero days that we found in a second."

"Took us like afternoons, not weeks and months of effort, and not needing to be a security expert, a Linux kernel expert, an Nvidia GPU driver expert, or a Kubernetes expert."

"The really scary part about this story is that it was autonomous agents people weren't monitoring, going and doing this by themselves because they were pursuing a goal of trying to find a data set to pass their eval. So they went out and hacked Hugging Face."

"You found a zero day in the HDF5 data format on Hugging Face. It's unbelievable."

"The agents were coordinating using file names on a JFrog Artifactory service that ran remotely. An agent would leave a note in the file name, and another agent would come back later and pick it up. They couldn't even access the contents of the files, just the names."