Wiz researchers demonstrate cross-tenant attack paths in Hugging Face AI services

Article Details

Attack Vectors

• Wiz Research uploaded a specially crafted PyTorch Pickle model that executed code when loaded through Hugging Face Inference API, yielding a reverse shell and shell-like command execution.
• Wiz Research reported that it could query the Amazon EKS node’s IMDS from its pod, obtain the node identity, and use aws eks get-token to generate a Kubernetes token with the node role.
• Using the Kubernetes token, Wiz Research listed pods and retrieved secrets associated with its pod; the article says these secrets could enable lateral movement within the EKS cluster.
• In Hugging Face Spaces, a researcher-supplied Dockerfile executed code during the image build. The build environment could push to and pull from a shared internal container registry, allowing images belonging to other customers to be overwritten.
• The article identifies malicious AI applications taking over shared CI/CD infrastructure as a potential supply-chain attack scenario; it does not report that this scenario was carried out.

Defensive Notes

• Enable IMDSv2 with a Hop Limit that prevents pods from accessing the instance metadata service and obtaining a node role.
• Require authentication for internal container registries and restrict access to the minimum necessary scope.
• Run untrusted AI models in a sandboxed environment, and assess model integrity before using models from untrusted sources.
• Maintain visibility and governance across the AI stack and assess risks including malicious models, training-data exposure, sensitive training data, and AI SDK vulnerabilities.