TL;DR Initial access Stage 1: from an OpenAI evaluation sandbox to a rooted launchpad Stage 2: Penetrating Hugging Face infrastructure using two injection vectors into our dataset processor The kill chain Day-by-day Day 1 (07-09): foothold and C2 Day 2 (07-10): self-referential search Day 3 (07-11): lateral movement begins Day 4 (07-12): using the stolen credentials Day 5 (07-13): exfil, persistence, cleanup Three lateral-movement techniques 1. Node impersonation and CSI token theft (from the prod-pod foothold) 2. Forged identity tokens (from the prod-pod foothold) 3. Supply-chain write access Command-and-control and exfiltration Building an improvised message protocol Evasion and self-migration How we intercepted and analyzed the attack What we changed Reflection: the asymmetry problem A companion technical writeup to our incident disclosure. This post walks through how the intrusion actually worked: the two initial-access vectors, how the agent pivoted and moved laterally, representative examples of the commands that were run and how we investigated with GLM 5.2 (an open-source model). Live credentials, internal hostnames, and specific indicators have been redacted or genericized, while the techniques are described exactly as observed by Hugging Face.