Hugging Face breached, a WordPress RCE, poisoned code completions - July 20, 2026
An autonomous AI agent breaches Hugging Face, a WordPress RCE found for twenty-five dollars, and language models out-discriminate humans in hiring.(0:00) - Intro(0:16) - Hugging Face breached by an autonomous AI agent - source(1:11) - A WordPress remote code execution flaw found for twenty-five dollars - source(2:00) - CodeTracer traces poisoned code completions back to training data - source(2:55) - Microsoft open-sources Dusseldorf, an out-of-band security testing platform - source(3:49) - Paidwork breach exposes twenty-three million gig workers - source(4:37) - Language models show more…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.