credentials
2 posts — newest first.
-
An agent breached Hugging Face in 4.5 days. The controls that would have stopped it are boring.
Hugging Face's July 2026 postmortem is the clearest agent-intrusion writeup we have. The failures were IMDS, admission policy, and one shared credential.
-
Your agents need identities, not API keys
Every AI agent is a non-human identity — most run on shared, long-lived API keys no IAM review sees. Per-agent identity and your credential blast radius.