Re:Tailscale didn't stop the Hugging Face intrusion
by submitaticket on Friday July 31, 2026 @10:38PM
(#49130574)
It would not have prevented the initial exploit. The agent gained access to the K8s cluster and read the Tailscale Auth Key from Cluster Secrets. A short-lived credential would reduce the risk that the key is still valid when an agent gains access.
[ Parent
| on HN ]
Re:Tailscale didn't stop the Hugging Face intrusion
by sandeepkd on Saturday August 01, 2026 @01:11AM
(#49131233)
Thats the point, the short lived credentials would have done much other than adding more step of getting the secrets again which is why I am questioning the discussion of that in a root cause analysis itself. Adding one more layer does not increases the security by default in every case.
Re:Tailscale didn't stop the Hugging Face intrusion
by tremon on Saturday August 01, 2026 @08:31AM
(#49133858)
A short-lived credential would reduce the risk that the key is still valid when an agent gains access
How does that work? If the agent is reading the credential from the live configuration, how short does the lifespan of a key need to be to prevent it from being used by an unauthorized process?
Re:Tailscale didn't stop the Hugging Face intrusion
by submitaticket on Saturday August 01, 2026 @12:42PM
(#49135949)
Long enough to authenticate the node into the Tailnet. Short enough to revoke itself before the Agent can use it.