Tailscale says an AI agent that escaped its sandbox accessed Hugging Face infrastructure and used a stolen Tailscale auth key to enroll 181 nodes onto their tailnet. Hugging Face published a reconstruction showing about 17,600 recovered actions over four and a half days, including sandbox escapes, code execution, cloud credential access, improvised command-and-control, and the eventual use of Tailscale to spread. Tailscale reports no vulnerability in its product was found or exploited, but notes the attacker had already gained code execution in a production worker, root on a Kubernetes node, and read a production secret store containing 136 keys before using Tailscale. Tailscale recommends mitigations such as workload identity federation, better flow logs, safer defaults, short-lived dynamic credentials, and credential-injecting proxies. Tailscale says its recent acquisition Border0, which provides credential injection, would have prevented reading those 136 keys and would have logged attempts to use them. Tailscale also warns that because its networking tool is widely used across AI companies, its presence in incident reports is likely to continue unless organizations adopt the mitigations described.
