The same blind spot let the attacker in and locked the defender out.
A boundary that cannot tell what is crossing it fails at both ends.
Hugging Face disclosed an intrusion this month worth reading twice — once for each end of it.
At the entrance: a malicious dataset abused two code-execution paths in the data-processing pipeline — a remote-code loader and a template injection in a dataset config. Reading the data executed it. The pipeline treated the upload as "just data," but the boundary could not tell data from code, so processing the file ran the attacker's code — which reached node-level access, harvested cloud and cluster credentials, and moved across internal clusters.
At the exit: the defenders hit the mirror image. When they tried to analyze the attack logs with hosted frontier models, the models refused — real attack commands and exploit payloads tripped safety guardrails that could not tell an incident responder from an attacker. So they ran the forensics on a self-hosted open-weight model instead, which also kept the stolen data and credentials inside their own perimeter.
One incident, two failures, same shape. Classify badly and you do not fail safe — you fail both ways: you admit what you should have stopped and block what you should have helped. The fix is not more guardrails or less trust in datasets. A boundary is only as strong as its ability to separate the safe case from the dangerous one.
A control that cannot tell friend from threat gets both wrong: it lets the attack in and keeps the defense out.