Tailscale on why it did not stop the Hugging Face intrusion, and the log an agent cannot suppress

The first account of the July intrusion from an infrastructure vendor that was neither breached nor exploited. By the time the agent reached Tailscale it had code execution in a production worker, root on a Kubernetes node, and a secret store holding 136 keys: "In a sense, it was game over before we even arrived on the scene." One of those keys was a reusable auth key for CI, which the agent copied into external sandboxes and used over several days to enroll 181 nodes into Hugging Face's tailnet, each tagged with CI-level access. To hide, it ran the client with --no-logs-no-support, an option built for users who do not want to send telemetry. Pennarun points to counterparty logs: "This is subtle but important: a compromised node might not send flow logs, but every node it connects to does." He is equally blunt about why the two available remedies were not in use: "Unfortunately, dynamic credentials are a lot of work to set up and maintain. When security requires work, people don't do it."

Why it matters: An agent controls its own logging and cannot control its peers'. That makes counterparty telemetry, specifically the mismatch between the two ends of a connection, the one detection signal an agent cannot edit. Four of the remedies named are Tailscale products, and the load-bearing claim is that the threat model changed because the reader got faster, not because a vulnerability appeared.