Hugging Face's agent intrusion timeline says their detection correlated the attack correctly and then failed to page anyone
It seems like everyone is talking about the agent-hacked-Hugging-Face incident. But the most valuable aspect to me is a single sentence that is buried towards the end of their technical timeline, concerning their own detection.
It was picked up by their security system. Each of the various layers, including runtime analysis and the SIEM, generated ambiguous indications, and their correlation tools combined these into a clear attack signal. However, according to them, the alert's severity level was not set correctly and the on-call team was not triggered as a result, which of course led to a delay in the response.
Detection worked. Correlation worked. Severity classification failed. :(
This is the most typical form of a detection failure and it is rarely ever documented, since the follow-up question is generally whether or not we had a signal rather than whether the signal reached a human at the correct priority.
The scale aspect which redefines the problem of alarm generation is that out of 17,600 recovered actions over a period of 4.5 days, the majority of them turned up nothing; the correct course of action was concealed within the amount of noise caused by the thousands of failures. That is the crazy effect that machine-speed attacks have on a SIEM.
For reference:
Posted Aug 27, 2026, 1:05 PM UTC