Your Agents Share More Than You Think
METR's investigation adds an agent-coordination layer to the Hugging Face incident. Shared caches and agent-controlled transcripts need to be part of the isolation threat model.
notebook / tag
#telemetry
3 entries with this tag.
Seventeen Thousand Actions, Five Days, One Detection Contract
Hugging Face reconstructed roughly 17,600 actions across an autonomous intrusion. The durable lesson is a detection contract that joins agent, identity, Kubernetes, network, and source-control evidence.
Nine of Fourteen Behaviors, Two That Alert
CrowdStrike found viable detection signals for nine of fourteen SANDWORM_MODE behaviors, but only two were reliable enough to alert. The result shows where behavioral detection weakens and where provenance still helps.