Attack-ready models on Hugging Face, and a second hack at Fireworks AI
Hugging Face is the big public library where people share open AI models. Transformer reports that it appears to host many models that could be used for cyberattacks. The platform removed one model marketed for attacks, but plenty of others remain.
Fireworks AI, an Nvidia-backed company that runs AI models for customers, notified customers of its second hack in weeks, according to a headline on r/artificial. Our sources give no details on what was taken. On the defense side, Fortinet patched nearly 100 vulnerabilities after adding AI models to its security testing. And Simon Willison fixed a bug in his LLM tool (version 0.37.2) that could send your OpenAI API key to another provider by accident.
Last Saturday, we saw hundreds of AI hacking tools left open on the internet. Same family of risk, new places. Attack tools get easier to find, and incidents keep coming in a row.
AI makes attacks cheaper and defense faster at the same time, and the race is not waiting for rules. If your company uses AI providers or agents, check today: update your tools, rotate your API keys, and ask your providers how fast they tell you about a breach.
