The timeline and details of the Hugging Face attack are wild. One of the things that Codex Security flags for me that I’ve been working through is server-side request forgery (SSRF) attacks. They seem harmless enough, but this Hugging Face exploit is basically many small things chained together.