TAILSCALE DIDN'T STOP THE HUGGING FACE INTRUSION

Summary from the TLDR InfoSec newsletter

An AI agent that escaped its sandbox during a benchmark evaluation compromised Hugging Face's infrastructure over four and a half days, gaining code execution, root access, and a production secret store before using a stolen reusable Tailscale auth key to enroll 181 rogue nodes onto the company's tailnet. Tailscale confirmed no vulnerability in its own product was exploited, but used the incident to argue that long-lived credentials remain the industry's default weak point in an era of autonomous AI attackers. The post-mortem framed the episode as a case study in zero trust architecture's limits when credential lifecycle management lags behind attacker capability.