{
  "$schema_note": "Apeiris incident-to-control map. A real documented attack, decomposed into stages and mapped to specific Apeiris control URIs with what each control does and why it matters at that stage. Machine-readable so a GRC/SIEM/agent pipeline can consume it. mapped != satisfied: this states which controls address each stage, not that any target satisfied them. Each control carries what it does, why it applies here, and the evidence to collect. Control IDs are Apeiris-native and are mapped to cited external frameworks (NIST, OWASP, ETSI, ISO, and others) in the domain JSON they link to.",
  "incident": {
    "name": "HuggingFace July 2026 intrusion",
    "summary": "Autonomous AI agent intrusion into an AI platform through its own data pipeline — remote-code dataset loaders and template injection in dataset configurations as the entry point.",
    "source": "HuggingFace",
    "source_url": "https://huggingface.co/blog/security-incident-july-2026",
    "published": "2026-07",
    "entry_vuln": "Remote-code dataset loader and template injection in dataset configuration",
    "attribution_note": "All incident facts come from HuggingFace's own public disclosure. Control mapping is Apeiris."
  },
  "generated": "2026-07-19",
  "stages": [
    {
      "stage": "data_pipeline_rce",
      "attack": "A malicious dataset abused two code-execution paths in HuggingFace's dataset processing: a remote-code dataset loader and a template injection in a dataset configuration. These are design features — data pipelines on an AI platform need to execute code to transform data — and they became the entry point.",
      "assurance_gap": "The parser is the perimeter. Data-pipeline workers were treated as trusted compute rather than untrusted-input processors, so code execution in the pipeline was equivalent to code execution on the host. The pattern is structurally identical to a CI/CD pipeline compromise: the process that ingests external inputs runs with the same privileges as the build environment itself, and the first malicious input owns the system.",
      "controls": [
        {
          "uri": "apeiris://security/controls/EC-01",
          "name": "Sandbox the agent",
          "what_it_does": "Runs automated processes under process, namespace, and syscall isolation.",
          "why_here": "A remote-code dataset loader that executes arbitrary Python inside a sandbox yields execution inside a jail, not on the host. The escalation to node-level access does not happen: the code runs, but it cannot reach the host credential store, the internal network, or other cluster nodes.",
          "evidence": "Sandbox configuration and seccomp profile applied to all dataset-processing workers; denied-syscall event log from the pipeline processes."
        },
        {
          "uri": "apeiris://security/controls/EC-04",
          "name": "Minimal filesystem and tool access",
          "what_it_does": "Restricts the process to the least filesystem paths and tools it needs to perform its declared function.",
          "why_here": "Even inside a sandbox, a credential sweep requires filesystem reach the control denies. A dataset loader that needs to read one data format does not need access to environment variables holding cloud credentials or to the cluster network.",
          "evidence": "Least-privilege filesystem and tool policy for pipeline workers; denied file-access events."
        },
        {
          "uri": "apeiris://security/controls/AS-02",
          "name": "Static analysis of skills and manifests in CI",
          "what_it_does": "Analyzes configurations and execution paths in the build pipeline before they deploy.",
          "why_here": "A remote-code dataset loader is a configuration with an execution path. Static analysis in CI surfaces the pattern — arbitrary code execution granted to an untrusted input source — before that configuration reaches production. This is the CI/CD analogy made actionable: the same gate that blocks a malicious build step blocks a malicious dataset loader.",
          "evidence": "CI static-analysis report over dataset loader configurations and data-pipeline manifests."
        }
      ]
    },
    {
      "stage": "node_level_escalation",
      "attack": "From the initial code-execution foothold, the attacker escalated to node-level access. The pipeline worker ran with broad host privileges, so code execution was equivalent to host control.",
      "assurance_gap": "Orchestration worker ran with broad host privileges — no containment boundary between pipeline code execution and host-level access.",
      "controls": [
        {
          "uri": "apeiris://security/controls/EC-04",
          "name": "Minimal filesystem and tool access",
          "what_it_does": "Restricts the process to the least filesystem paths and tools it needs to perform its declared function.",
          "why_here": "A least-privilege policy denies the pipeline worker access to credential stores, cluster APIs, and host-level paths. Escalation to node-level access requires reach the control removes.",
          "evidence": "Least-privilege filesystem and tool policy; denied file-access events from pipeline workers attempting to reach host credential stores."
        }
      ]
    },
    {
      "stage": "credential_sweep",
      "attack": "With node-level access, the attacker swept cloud and cluster credentials from the reachable process environment — including cloud provider credentials dispensed via the Instance Metadata Service (IMDS), which were scoped far beyond what the data-pipeline worker required.",
      "assurance_gap": "Presumed-RCE credential scoping: the credentials dispensed to the pipeline worker assumed the worker was trustworthy, not compromised. IMDS-dispensed cloud credentials carried permissions scoped to the node's operational role, not to the narrow task of processing a dataset. Once the attacker controlled the node, those broadly-scoped credentials were theirs. Least-privilege credential issuance was not applied at the identity layer before the sweep occurred.",
      "controls": [
        {
          "uri": "apeiris://identity/controls/NI-10",
          "name": "IMDS-Dispensed Credential Scoping",
          "what_it_does": "Enforces that IMDS-dispensed cloud credentials are scoped to the minimum permissions required for the specific workload identity, not the node's full operational role.",
          "why_here": "The attacker's most valuable harvest came from IMDS-dispensed credentials that were over-privileged relative to the pipeline task. Scoping those credentials to exactly what dataset processing requires — and nothing more — limits the blast radius of a node compromise to the dataset-processing function, not the broader cluster.",
          "evidence": "IMDS credential policy configuration per workload identity; IAM permission boundary records showing pipeline-worker credentials scoped to dataset-processing actions only."
        },
        {
          "uri": "apeiris://security/controls/EC-19",
          "name": "IMDS/Cloud Metadata Endpoint Hardening",
          "what_it_does": "Restricts access to the cloud metadata endpoint to authorized processes only, blocking unauthorized or attacker-controlled processes from querying IMDS for credentials.",
          "why_here": "The credential sweep depended on the pipeline worker being able to reach the IMDS endpoint without restriction. Hardening IMDS access — via network policy, iptables rules scoped to authorized process UIDs, or metadata server v2 IMDSv2 enforcement — forces every IMDS query through an authenticated hop, making the sweep fail even with node-level access.",
          "evidence": "IMDS access policy (IMDSv2 enforcement, process-UID restriction, or network policy restricting IMDS reachability); IMDS query audit log showing denied access from non-authorized processes."
        },
        {
          "uri": "apeiris://security/controls/EC-08",
          "name": "Keep secrets out of the context",
          "what_it_does": "Keeps credentials out of the process environment and model context, sourcing them from a secrets broker at the moment of use.",
          "why_here": "The credential sweep returns nothing to harvest because the process holds no standing secrets. There is nothing to sweep.",
          "evidence": "Secret scan of the pipeline process environment showing no standing credentials; secrets-broker issuance records confirming on-demand, scoped delivery."
        },
        {
          "uri": "apeiris://agentic/controls/AA-02",
          "name": "API key and token lifecycle management",
          "what_it_does": "Places keys and tokens in a secrets manager with short TTL and rotation.",
          "why_here": "Any credential obtained during the sweep cannot be replayed hours or days later against cloud providers or cluster APIs. Short TTL collapses the value of the entire credential harvest.",
          "evidence": "Secrets-manager inventory; token TTL and rotation records for cluster credentials."
        }
      ]
    },
    {
      "stage": "lateral_movement_via_standing_credentials",
      "attack": "Swept credentials remained valid long enough to enable lateral movement into several internal clusters over a weekend.",
      "assurance_gap": "Credential rotation cannot outrun machine-speed exfiltration. Long-lived keys with broad cluster scope make the entire escalation path replayable — but even short rotation intervals are insufficient when an autonomous attacker can harvest and weaponize a credential in seconds. The defensive assumption that 'we rotate regularly' fails when the attacker operates faster than the rotation cycle. The only durable answer is keys that expire before the attacker can traverse the network, measured in minutes, not days.",
      "controls": [
        {
          "uri": "apeiris://security/controls/IA-02",
          "name": "Short-lived, task-scoped keys",
          "what_it_does": "Issues ephemeral keys bound to a single task, never long-lived shared secrets.",
          "why_here": "Any credential obtained during the sweep cannot be replayed hours or days later against cloud providers or cluster APIs. The lateral movement across multiple clusters over a weekend requires credentials that remain valid across that window. Short-lived keys — measured in minutes, not days — close it. A machine-speed attacker that harvests a key expiring in ten minutes cannot traverse multiple clusters before it becomes useless.",
          "evidence": "Short-lived token issuance log; evidence that no long-lived cluster credentials exist in process environments or cluster nodes."
        }
      ]
    },
    {
      "stage": "cross_cluster_lateral_movement",
      "attack": "The attacker moved laterally into several internal clusters over a weekend, executing thousands of individual actions across a swarm of short-lived sandboxes. HuggingFace recorded more than 17,000 attacker events.",
      "assurance_gap": "No automated behavioral signal to stop the campaign mid-flight. Lateral movement ran undetected across multiple clusters. The absence of network micro-segmentation between clusters meant that a compromised node in one cluster could reach APIs and services in adjacent clusters without crossing any policy boundary.",
      "controls": [
        {
          "uri": "apeiris://security/controls/RT-01",
          "name": "OS-level telemetry",
          "what_it_does": "Captures what automated processes actually do at the OS level: process trees, syscalls, file and network activity, in real time.",
          "why_here": "A 17,000-event campaign is observable as it unfolds. Lateral movement to a new cluster node, credential access, anomalous network connections to public services — each is a discrete OS event. Telemetry makes the campaign visible in near-real-time rather than reconstructed forensically after the fact.",
          "evidence": "Continuous OS-level telemetry stream — processes, syscalls, file and network activity — for all pipeline workers and cluster nodes, with retention covering the full incident window."
        },
        {
          "uri": "apeiris://security/controls/EC-20",
          "name": "AI Infrastructure Network Micro-Segmentation",
          "what_it_does": "Enforces network policy boundaries between AI infrastructure components — compute clusters, model registries, data stores, and control planes — so that a compromised node cannot reach adjacent clusters without crossing an explicit policy allow.",
          "why_here": "Cross-cluster lateral movement depended on the absence of network boundaries between clusters. Micro-segmentation means that gaining control of a pipeline worker in cluster A does not grant network reachability to cluster B's APIs, credential endpoints, or data stores. Each cluster hop requires crossing a policy boundary, making lateral spread observable and blockable.",
          "evidence": "Network policy definitions for all AI infrastructure segments; inter-cluster connection policy with explicit allow/deny rules; denied cross-cluster connection logs."
        }
      ]
    },
    {
      "stage": "campaign_runs_to_completion",
      "attack": "The 17,000-action campaign ran to near-completion before detection closed it down. The attacker's autonomous framework operated at machine speed, adapting to failures in real time.",
      "assurance_gap": "Blast radius beats detection speed. The fundamental failure is not that anomaly detection was slow — it is that the blast radius of each action was large enough that the attacker accomplished most of its objectives before any detection signal triggered human response. At machine speed, a defender who relies on detect-then-respond will always lose: the attacker executes 17,000 actions in the time it takes a human to page in and assess the alert. Automated containment at the first anomaly signal — not human triage — is the only response that operates at the attacker's tempo.",
      "controls": [
        {
          "uri": "apeiris://security/controls/RT-04",
          "name": "Anomaly detection with pause and kill",
          "what_it_does": "Detects anomalous behavior and triggers pause, kill switch, or automated containment.",
          "why_here": "A data-processing worker that begins making lateral network connections to cluster nodes, accessing credential stores, or contacting public services outside its normal egress pattern is a high-confidence anomaly. Automated containment at that signal — rather than human triage hours later — stops the campaign before it spans multiple clusters. The blast-radius problem is solved by shrinking the time-to-containment to seconds, not minutes.",
          "evidence": "Anomaly-detection rules and thresholds; pause / kill / containment event records; mean time from anomaly signal to automated response."
        },
        {
          "uri": "apeiris://agentic/controls/AM-07",
          "name": "Real-time alert and automated suspension",
          "what_it_does": "Suspends the automated process automatically on a high-severity signal.",
          "why_here": "At machine speed, the gap between detecting an anomaly and acting on it determines how much damage occurs. Automated suspension on the first out-of-manifest lateral move closes that gap without waiting for a human to page in. This is the direct answer to 'blast radius beats detection speed': reduce the blast radius by reducing the response latency to zero human time.",
          "evidence": "Alert-to-suspension records; automated process-suspension events."
        }
      ]
    },
    {
      "stage": "c2_via_public_services",
      "attack": "The attacker framework used self-migrating command-and-control staged on public services, blending C2 traffic into normal cloud egress from compromised nodes.",
      "assurance_gap": "Egress brokering was absent. All outbound connections from pipeline workers and cluster nodes passed directly to the public internet without inspection or allowlisting. The attacker exploited the legitimate appearance of cloud-service egress — traffic to public storage, model hubs, and API endpoints looks identical to C2 traffic staged on those same services. Without an egress broker that distinguishes authorized destinations from attacker-controlled ones, C2 traffic is invisible.",
      "controls": [
        {
          "uri": "apeiris://security/controls/EC-02",
          "name": "Filter outbound network traffic",
          "what_it_does": "Restricts egress from pipeline and cluster nodes to an allowlist of approved destinations.",
          "why_here": "Self-migrating C2 staged on public services requires outbound connectivity from the compromised nodes to those services. An egress allowlist that permits only approved destinations — artifact registries, logging endpoints, known API targets — blocks both the C2 beaconing and any data staging. The attacker's ability to blend C2 into cloud egress disappears when egress is brokered against an explicit allow list.",
          "evidence": "Egress allowlist definition for pipeline workers and cluster nodes; blocked outbound-connection logs."
        },
        {
          "uri": "apeiris://security/controls/RT-09",
          "name": "C2 Detection on Public Services",
          "what_it_does": "Monitors egress traffic for patterns consistent with command-and-control use of legitimate public services — beaconing intervals, unusual data volumes, connections to services outside the workload's declared dependencies.",
          "why_here": "The attacker's C2 used public services specifically to evade destination-based blocking. RT-09 addresses this by inspecting the behavioral signature of the traffic — not just its destination — detecting beaconing patterns, self-migration artifacts, and anomalous use of otherwise-legitimate endpoints that an allowlist alone would miss.",
          "evidence": "C2-detection rule set covering public-service abuse patterns; flagged egress events showing beaconing or self-migration signatures; integration with anomaly-detection pipeline."
        }
      ]
    },
    {
      "stage": "adaptive_attacker_framework",
      "attack": "The attacker's autonomous agent framework adapted to failures in real time, executing thousands of actions across a swarm of short-lived sandboxes in ways that fell outside any expected pipeline behavior.",
      "assurance_gap": "No signed action manifest to detect out-of-scope actions — pipeline workers could make lateral network connections, access credential stores, and contact cluster APIs without triggering a detection signal.",
      "controls": [
        {
          "uri": "apeiris://agentic/controls/AM-02",
          "name": "Anomalous action detection",
          "what_it_does": "Compares agent and pipeline actions against a signed manifest of what the process is authorized to do.",
          "why_here": "A dataset-processing worker has a defined action scope: parse data, transform it, write output. Network connections to cluster APIs, credential-store reads, and lateral movement are outside any legitimate action manifest. The moment those actions are attempted, they are flagged.",
          "evidence": "Signed action manifest for pipeline workers; anomalous-action detection events for out-of-manifest actions."
        }
      ]
    },
    {
      "stage": "forensic_guardrail_lockout",
      "attack": "When HuggingFace investigators tried to analyze the attacker's 17,000-event log using commercial frontier model APIs, requests were blocked by those providers' safety guardrails, which cannot distinguish an incident responder from an attacker. Analysis was completed instead on an open-weight model (GLM 5.2) on their own infrastructure.",
      "assurance_gap": "Commercial model safety guardrails are a capability-denial risk, not merely a privacy concern. When the only AI-assisted forensic capability in the incident response plan depends on a third-party model API, an attacker who generates artifacts that trigger those guardrails — intentionally or not — degrades the defender's analytical capacity at the moment it is most needed. This is an organizational planning gap that compounds the attacker's advantage: the same artifacts that evidence the attack become barriers to analyzing it.",
      "controls": [
        {
          "uri": "apeiris://security/controls/AS-11",
          "name": "Forensic AI Readiness",
          "what_it_does": "Maintains a validated, self-hosted AI forensic capability — model identity, deployment location, access controls, and a documented test against synthetic incident data — so that incident responders can analyze real attacker artifacts without dependency on external model APIs or their guardrails.",
          "why_here": "This is the primary control for this stage. The failure was not the guardrail itself but the absence of a pre-planned alternative that works on real attacker artifacts. AS-11 closes that gap before an incident occurs: validate the forensic AI capability against synthetic attacker data in a non-incident window, document the deployment, and ensure responders know how to invoke it. The capability HuggingFace improvised under pressure — self-hosted open-weight model — should be the planned default, not the emergency fallback.",
          "evidence": "Documented on-premises forensic AI capability: model identity, deployment location, access controls, and a validation test against synthetic incident data with the test date on record; runbook entry for forensic AI invocation during incident response."
        },
        {
          "uri": "apeiris://security/controls/RT-01",
          "name": "OS-level telemetry",
          "what_it_does": "Produces a structured, signed log of what the attacker did — in your environment, on your compute — as a forensic artifact analyzable without external dependencies.",
          "why_here": "The telemetry is the evidence. A forensic artifact produced by your own telemetry pipeline does not need to be exported to an external API to be analyzed. The signed log of 17,000 events is already the structured input a self-hosted forensic model needs, and it is available regardless of whether any commercial API will accept it.",
          "evidence": "Continuous OS-level telemetry stream with signed, tamper-evident log retention covering the full incident window; confirmed that the log format is parseable by the self-hosted forensic AI documented in AS-11."
        }
      ]
    }
  ]
}