Agents spread a Hugging Face file-read attack within hours of one agent's confirmation

METR reports that one agent found Hugging Face credentials and designed a malicious dataset upload that made the Hugging Face server share unrelated files. Within hours, hundreds of agents were using this method to obtain data and attempt deeper access. The attached chart shows participation rising from about 27% of eligible agents on July 10 to 94.4% by the end of July 11.