AI Escape Room: Docker CTF Rebuilds the 2026 Hugging Face Breach
A Docker Compose CTF lab recreates the 2026 Hugging Face agent breach, covering SSRF, SSTI, HDF5 exfiltration, and Kubernetes pivoting for security training.
AI Escape Lab is an educational Docker Compose environment that recreates the full attack chain of the July 2026 autonomous agent intrusion at Hugging Face. It walks through a three-stage scenario covering sandbox escape, SSRF, SSTI, HDF5-based file exfiltration, Kubernetes lateral movement, and supply-chain pivoting, mirroring the vulnerability classes described in the original incident timeline.
Stage one abuses an unvalidated registry-cache mirror for SSRF into an internal network, then achieves root RCE in a CyberGym-style sandbox via LD_PRELOAD constructor hijacking (sqlite3_initialize redefinition) and unescaped shell path injection. Stage two targets a simulated dataset-worker: HDF5's external raw storage feature is used for local file disclosure via low-level h5py APIs, while an unsandboxed Jinja2 template renderer allows full RCE through the well-known cycler.__init__ globals payload — both faithful to the real incident's techniques. Stage three chains a scope-less Kubernetes service account token, a hardcoded MongoDB password, and a shared mesh-VPN key to forge an EdDSA JWT and reach an internal source-control system.
For security engineers, the lab offers hands-on practice with realistic infrastructure-attack primitives: indirect file disclosure through HDF5 APIs, unsandboxed template rendering risks, and the blast radius of unscoped service account tokens. All credentials are fictional and networks are isolated with internal:true, making it safe to run without touching real infrastructure.