AI agents are now running full attack chains on their own, Romania's land registry got wiped after a failed extortion attempt, and Microsoft shipped its biggest Patch Tuesday on record. Here's what mattered this week.
- Hugging Face was breached — by an autonomous AI agent, not a person. ~17,000 automated actions, zero hands on a keyboard.
- Microsoft's July Patch Tuesday fixed ~570 vulnerabilities, including two actively exploited zero-days and a public BitLocker bypass.
- Romania's entire land registry database got wiped after the operator refused to pay an extortion demand.
- CISA added new actively-exploited flaws to its KEV catalog — file-upload bugs in iCagenda and Balbooa Forms.
- The D1R extortion group claims to have stolen data from Synopsys and Bosch.
- The FBI seized NetNut, a residential proxy service linked to the two-million-device Popa botnet.
The story of the week: an AI agent breached Hugging Face — with no human at the keyboard
This is the one worth sitting with. Hugging Face, the largest open-source AI model repository on the internet, disclosed that its production infrastructure was compromised over a single weekend by an autonomous AI agent framework — not a human operator directing tools, but an agent independently chaining together the entire attack.
How it happened: the attacker uploaded a malicious dataset that abused two code-execution paths — a template injection in a dataset configuration and a flaw in Hugging Face's remote-code dataset loader — to get code running on a processing worker. From there, the agent escalated privileges, moved laterally across internal clusters, and harvested credentials, all on its own.
The scale: researchers logged more than 17,000 individual automated actions across a swarm of short-lived sandboxes, with self-migrating command-and-control infrastructure staged on public services.
The twist: Hugging Face's own AI guardrails got in the way of its incident response — mainstream frontier models refused to help analyze the malicious code, so the team had to fall back to an open-weight model (GLM-5.2) to do the forensic work fast enough to keep pace with the attacker.
Hugging Face says it's found no evidence (yet) that public-facing models, datasets, or Spaces were tampered with, and that its software supply chain is "verified clean." The vulnerable code paths are now closed, credentials rotated, and detection improved. But this is being called the first fully end-to-end, agent-driven attack against a major AI platform's production environment — and it lines up with something the industry has been predicting for a while: AI doesn't just help attackers write better phishing emails anymore, it can run the whole operation.
Why it matters for defenders: if you run anything that ingests third-party datasets, models, or "trust_remote_code=True" style pipelines, this is your reminder that the data layer is now an execution layer. Audit it like one.
Microsoft's biggest Patch Tuesday yet — 570 vulnerabilities, 2 active zero-days
July's Patch Tuesday addressed roughly 570 vulnerabilities — a record volume — including two zero-days already being exploited in the wild:
- CVE-2026-56164 — SharePoint Server
- CVE-2026-56155 — Active Directory Federation Services
There's also a publicly disclosed BitLocker bypass in the mix. Fortinet, F5, Splunk, and Dell all shipped critical patches the same week, and a malicious Chrome extension was caught exfiltrating browsing data from over a million users.
Part of what's driving the record volume: Microsoft is leaning more heavily on AI for vulnerability discovery and patch generation — which cuts both ways, since faster discovery by defenders tends to mean faster discovery by attackers too.
Action item: prioritize the SharePoint and ADFS zero-days this week if you haven't already — both are confirmed exploited, not just theoretical.
Romania's land registry, wiped after a failed extortion attempt
On July 14, Romania's National Agency for Cadastre and Real Estate Advertising (ANCPI) — the country's land registry — was breached by an attacker using valid credentials. After an extortion attempt failed, the attacker deleted the production database and, by their own claim, attempted to destroy backups too.
The fallout was immediate: property transactions froze, notaries couldn't authenticate documents or record mortgages, and government services depending on ANCPI went dark. The agency has since confirmed it's rebuilding its network, helped along by an offline backup the attacker apparently couldn't reach.
This isn't an isolated incident — Slovakia's land registry went offline in a similar attack in 2025, Lithuania's State Register Center was infiltrated in May 2026 with over 600,000 records taken, and researchers have linked the actor behind the Romania attack to a string of similar campaigns across Eastern Europe. State registries are becoming a recurring target for destructive, extortion-driven attacks.
Takeaway for your own backup strategy: offline, immutable backups aren't optional anymore — they're the difference between "we're rebuilding" and "we're gone."
CISA KEV additions worth knowing
CISA added new actively-exploited flaws to its Known Exploited Vulnerabilities catalog this week:
- Unrestricted file-upload vulnerabilities in iCagenda and Balbooa Forms
Earlier in the month, CISA also flagged three other actively-exploited flaws, and multiple Windows RDP vulnerabilities were found leaking sensitive data over the network ahead of this month's fixes.
If any of these show up in your external attack surface, they jump the patching queue — KEV listing means confirmed exploitation, not just risk.
Extortion & breach roundup
- D1R cybercrime group claims to have stolen data from Synopsys and Bosch, threatening to leak it without payment.
- A global car rental service suffered a data leak exposing thousands of drivers.
- Deutsche Bank is facing renewed breach concerns after a ransomware group posted alleged "evidence" of stolen data.
Infrastructure takedown: FBI seizes NetNut proxy network
The FBI, working with industry partners, seized hundreds of domains tied to NetNut, a large residential proxy service operated by the publicly traded Israeli firm Alarum Technologies. The action followed research connecting NetNut to the Popa botnet — a network of at least two million compromised devices. Residential proxy services like this are a favorite tool for credential stuffing and fraud operations because traffic blends in with legitimate home users, so a takedown at this scale is a meaningful disruption.
Closing thought
The Hugging Face incident is the story to actually internalize this week. We've talked about "agentic attackers" as a future problem for a couple of years now — this is the first well-documented case of one running an entire intrusion chain start to finish. If your threat model still assumes a human is pacing the attack, it's time to update it.
Stay patched, stay backed up (offline), and audit anything ingesting untrusted data or code.
Sources: BleepingComputer, The Hacker News, Axios, Forbes, Hugging Face's own incident disclosure, CybersecurityNews.com, GBHackers, SecurityWeek, Cybernews, Help Net Security, Risky Business, NetworkTigers.
Top comments (0)