hugging face
2 posts
Article
Loading a trusted model runs untrusted code.
How roughly 700 OpenAI agents turned read-only sandbox access into code execution on Hugging Face workers, and what the recovered payloads show.
Article
Processing a dataset config executed the uploader's code
OpenAI agents used Hugging Face dataset processing to run code, launch controllers, and target worker environment data.