4 ms·

They don't seem to explain how it managed to find this unauthenticated endpoint hosted on Modal's platform.

• simonw 2mo ago
  Modal are a hosting provider. It sounds to me like someone building on Modal deployed their own product that had an unauthenticated endpoint that could be used to launch and interact with a container.
  • what 2mo ago
    That doesn’t explain how the endpoint was found…
    • brunoarueira 2mo ago
      Through the timeline, Hugging Face said that the rogue agent ran quietly and do a bunch of code search, so probably the endpoint is/was public through some repositories or the CyberGym style announce something like a broadcast. I don't have any expertise on this, just ideas that came to my mind!
  • deleted 2mo ago
    [deleted]