2 months ago
- Unauthorized access to internal datasets and credentials occurred, with ongoing assessment of potential impact on partners and customers.
- The intrusion exploited vulnerabilities in the data-processing pipeline via a malicious dataset, leading to node-level access and lateral movement within internal clusters.
- An autonomous agent framework executed thousands of actions across sandboxes, matching industry-predicted 'agentic attacker' scenarios.
- Response actions included fixing vulnerabilities, eradicating footholds, rotating credentials, deploying additional controls, and collaborating with cybersecurity specialists and law enforcement.
- AI-assisted detection and LLM-driven analysis were used to quickly reconstruct the attack timeline and identify indicators of compromise, reducing analysis time from days to hours.
- A challenge arose as commercial model safety guardrails blocked forensic analysis of attack data, leading to the use of an open-weight model (GLM 5.2) on internal infrastructure to avoid data exposure.
- The incident highlights the reality of AI-driven offensive tooling, emphasizing the need for defenders to have self-hosted models ready to avoid guardrail lockouts and protect sensitive data.
- Recommendations for the community include rotating access tokens and reviewing account activity, with contact provided for security concerns.