Ep 48 - OpenAI Hacked Hugging Face, Called It Research, and PSIRT Wasn't Ready

🎙️ Coffee, Chaos and ProdSec, Ep 48

An AI lab's internal eval broke its own sandbox, hacked a production environment that wasn't theirs, and grabbed the answers to its own benchmark. Nobody told it to.

This week Cameron and Kurt break down the Hugging Face and OpenAI incident, the dataset loader exploit, the credential theft, and the model that built its own command and control inside someone else's infrastructure with zero human at the keyboard.

Then they get into what most security teams still aren't ready for, Product Security Incident Response versus the classic SOC, and why an incident living entirely in application code needs its own response function.

If you work in Application Security, Product Security, DevSecOps, Security Architecture, or Cybersecurity and AI, this one's required listening.

☕ New episodes every Wednesday.

Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.