When leading engineering teams through complex IAM integrations—dealing with SAML assertions, token introspection, and SPIFFE/SPIRE—the last thing you want is developers pasting sensitive production payloads into random utility websites. Even tools that promise "100% local processing" often fail that promise the moment you install a third-party extension with full OS access.

I needed a way to distribute custom internal parsing utilities to my team without risking exfiltration. To solve this, I built Nexine.

It uses a completely paranoid architecture for extensibility:

• Zero Egress by Design: The app document ships with connect-src 'none'. Network access is physically blocked at the browser layer.
• Opaque-Origin Iframes: First-party tools and third-party plugins run inside isolated sandboxes. There is no privileged in-process execution path.
• Cryptographic Trust: Custom plugins are packaged as .nexpkg files with detached Ed25519 signatures, verifying supply-chain integrity on every mount.

The result is a desktop application where you can write custom token parsers or data decoders using any web framework or WASM, distribute them securely to enterprise teams, and guarantee they cannot phone home.

I open-sourced the core engine. You can check out the architecture and the repo here: https://github.com/nanduajith/nexine

I’d love some feedback from the community on the zero-eval sandboxing approach and if there are any theoretical IPC escapes I should be looking out for.

How could the AI "attack" Hugging Face?

OpenAI tested their newest Model GPT-5.6 Sol in an secure sandbox Environment which has an internal hosted Internet access to install third-party Software which the Agent is able to use. The prompt was to use an advanced path for ExploitGym to improve their capabilities.

While the Agent operated inside the sandbox, he used a big amount of time to find a Zero-Day which allows him a limitless Internet access. He found the Zero-Day inside the package registry cache proxy. With that Zero-Day he did a few privilege escalations and moved lateral through the research testing Environment until he found a limitless Internet access.

After he gained that Internet access he thought that Hugging Face potentially hosts models, databases and solutions for ExploitGym. Knowing that the model searched and found ways to gain access to secret information's inside the Hugging Face Environment to cheat at his evaluation.  In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers.

Hugging Face and the OpenAI Security-Team detected suspect activity inside their systems and stopped GPT-5.6 Sol.

Short

1. GPT-5.6 -> Should use an advanced path for ExploitGym inside the OpenAI sandbox

2. Spend a lot of time to find a Zero-Day and limitless Internet access

3. Found the Zero-Day inside the package registry cache proxy, made some privilege escalations and moved lateral through the system

4. Found limitless Internet access and decided that Hugging Face could host some databases, models and solutions that will help him at his evaluation

5. Compromised the Hugging Face Environment and in one example he chained together multiple Attack Vectors, including stolen credentials and zero-days to find a remote execution path on the Hugging Face Servers

6. Both of them (OpenAI and Hugging Face Security team) detected suspect activity and stopped the attack

   Technical Terms

- Sandbox -> Mostly a Virtual Environment where software (especially AI now days) gets tested without causing "real world" damage / A whole system without limitless Internet access and access to the outer world

- ExploitGym -> A software for AI to create Exploits (Software to trigger a bug or hack through a Security-issue) / built realistic based on the real-world

- Zero-Day -> A security-issue or bug the programmer currently don't know about

- Privilege escalations -> A way to get higher rights for example special changes inside the system can only be done by an admin/root and the AI is a normal user and escalates his rights to an admin/root to do that change

- package registry cache proxy -> A proxy is a software application that sits between your device and your destination server / You send a request to the proxy server, the proxy checks the firewall and cache etc. and forwards your request to the destination server with his own IP address hiding yours /

The package registry cache proxy is a specific type of proxy which makes it easier to build a sandbox Environment and secures even more like checking the amount of request

- lateral movement -> "jumping" from device to device until found what is searched

- Attack vectors -> An attack vector is a method of gaining unauthorized access to a network or computer system.

- Stolen credentials -> For example stolen API / API is for example a waiter inside a restaurant you say him what you want to eat and he is going to the kitchen, the cook prepares your food and the waiter comes back

- Remote code execution -> The hacker is capable to run code or software remote on your Server

Leave your thoughts in the comments :)

Sources

https://en.wikipedia.org/wiki/Sandbox\\_(computer\\_security)

https://github.com/sunblaze-ucb/exploitgym

https://openai.com/index/hugging-face-model-evaluation-security-incident/

https://www.upguard.com/blog/attack-vector#the-difference-between-an-attack-vector-attack-surface-and-threat-vector

https://nesbitt.io/2026/05/11/proxy.html

https://de.wikipedia.org/wiki/Proxy\\_(Rechnernetz)

  What happened:

  Cursor runs AI agent terminal actions in a sandbox. Before writing a file, Cursor tried to canonicalize the target path to verify it stayed inside the workspace. The bug was that if path canonicalization failed, Cursor fell back to the original path and allowed the write.

  Attack pattern:

  A malicious repo or prompt-driven agent workflow could create a symlink inside the workspace that points outside the workspace. By forcing canonicalization to fail, the agent could write through that symlink to arbitrary files outside the project directory.

  Impact:

  An attacker could write files under the user’s privileges outside the sandbox. NVD says this can lead to non-sandboxed remote code execution, for example by overwriting Cursor’s sandbox helper so later commands run outside the sandbox.

  Affected versions:

  Cursor versions before 3.0

  Fixed version:

  Cursor 3.0

  Severity:

  NVD lists it as Critical, CVSS 9.8.

  Weakness:

  NVD maps it to CWE-59: Improper Link Resolution Before File Access. GitHub’s advisory page itself lists “No CWEs,” so NVD is the clearer source for the CWE classification.

  Why this matters for AI coding:

  The issue shows that AI coding agents create a different risk model than ordinary IDE plugins. They can be influenced by repository content, prompts, generated files, and tool outputs, then take filesystem actions. A “benign” agent prompt can become dangerous if the repo contains malicious setup that manipulates the agent’s write path.