A note on the Hugging Face agent incident

Hugging Face published a technical timeline of a recent agent intrusion, which names Modal as the third-party infrastructure the agent used as a launchpad.

Modal's platform and isolation were not compromised in any way.

The environment involved was a customer's own application. It was deployed to a endpoint that was publicly accessible without authentication, and it was designed to compile and execute code submitted by anyone on the internet in a Modal Sandbox. The code execution the attacker obtained took place inside that customer's own container, within Modal's standard sandbox isolation boundary. No other customer workloads were affected.

While customers can expose Sandboxes to unauthenticated traffic, this is never the default, and Modal provides the authentication, network, and monitoring controls to keep production workloads locked down. We recommend that anything exposed to the public internet require authentication, IP allowlist, restrict its outbound network access to only what it needs, and treat any code or input it accepts from users as untrusted.

For additional questions, email security@modal.com.