In one case, an agent inside Hugging Face submitted a pull request to an internal repository containing code intended to provide access to another part of Hugging Face.

“So in one case, you know, an agent was inside of Hugging Face already submitting a pull request to an internal Hugging Face repository that would inject some malicious code that would let it access yet a different part of Hugging Face.”