Security incident disclosure — July 2026

Summary

An intrusion into part of production infrastructure was driven end to end by an autonomous AI agent system, accessing a limited set of internal datasets and several credentials used by services. The attack began through two code-execution paths in dataset processing, then escalated from a worker to node-level access and moved laterally across internal clusters while running thousands of actions in short-lived sandboxes. AI-assisted anomaly detection surfaced the compromise, and LLM-driven analysis of more than 17,000 attacker events reconstructed the timeline, identified indicators, mapped credentials, and separated impact from decoys. Hosted frontier models initially blocked forensic requests containing attack artifacts, so the investigation used zai-org/GLM-5.2 on internal infrastructure. The initial vulnerabilities were closed, affected infrastructure rebuilt, credentials rotated, and cluster controls and alerting strengthened; assessment of possible partner or customer impact remains ongoing.

Takeaways

1. 1

   The initial access used a remote-code dataset loader and a template-injection flaw in dataset configuration to execute code on a processing worker, followed by node-level credential harvesting and lateral movement across internal clusters.

2. 2

   LLM-driven analysis of more than 17,000 recorded attacker events reconstructed the timeline, extracted indicators of compromise, mapped touched credentials, and separated genuine impact from decoy activity in hours rather than days.

3. 3

   Hosted model safety guardrails blocked forensic requests containing real attack commands and payloads, leading the investigation to use zai-org/GLM-5.2 locally so attacker data and referenced credentials stayed inside the environment.