--- title: Argo CD RCE still unpatched, Hugging Face breached by... description: An unauthenticated RCE in Argo CD's repo-server remains unpatched as of July 2026, with the default Helm chart still shipping without network policies — full... canonical: https://daily.dev/posts/argo-cd-rce-still-unpatched-hugging-face-breached-by-autonomous-ai-agent-lqbhd84oi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Argo CD RCE still unpatched, Hugging Face breached by autonomous AI agent | daily.dev og:description: An unauthenticated RCE in Argo CD's repo-server remains unpatched as of July 2026, with the default Helm chart still shipping without network policies — full... og:url: https://daily.dev/posts/argo-cd-rce-still-unpatched-hugging-face-breached-by-autonomous-ai-agent-lqbhd84oi og:image: https://api.daily.dev/og/posts/lqbhd84Oi.png og:image:alt: Argo CD RCE still unpatched, Hugging Face breached by autonomous AI agent og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Argo CD RCE still unpatched, Hugging Face breached by autonomous AI agent **[Backend Digest](https://daily.dev/sources/backend_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary An unauthenticated RCE in Argo CD's repo-server remains unpatched as of July 2026, with the default Helm chart still shipping without network policies — full cluster takeover is a single crafted gRPC call away. Separately, Hugging Face disclosed a breach where an autonomous AI agent framework exploited code-execution flaws in their dataset pipeline, harvested cloud credentials, and moved laterally across internal clusters. Modal rebuilt its sandbox scheduler to hit 1 million concurrent sandboxes in under a minute, with median start times under 500ms. OpenTelemetry Go finally ships compile-time auto-instrumentation at v1, closing a long-standing gap for Go shops that didn't want to touch eBPF agents. ## Content **TLDR:** An unauthenticated RCE in Argo CD's repo-server remains unpatched as of July 2026, with the default Helm chart still shipping without network policies — full cluster takeover is a single crafted gRPC call away. Separately, Hugging Face disclosed a breach where an autonomous AI agent framework exploited code-execution flaws in their dataset pipeline, harvested cloud credentials, and moved laterally across internal clusters. Modal rebuilt its sandbox scheduler to hit 1 million concurrent sandboxes in under a minute, with median start times under 500ms. OpenTelemetry Go finally ships compile-time auto-instrumentation at v1, closing a long-standing gap for Go shops that didn't want to touch eBPF agents. --- ## Argo CD repo-server RCE: unauthenticated, unpatched, default Helm chart leaves it open Synacktiv's disclosure details how any pod that can reach Argo CD's repo-server — which ships with no authentication and no network policy by default — can call GenerateManifest with a crafted kustomize --helm-command flag pointing to an attacker-controlled script. From there: read the Redis password from env vars, poison the manifest cache, let the application controller auto-sync malicious manifests, full cluster takeover. Reported January 2025, still unpatched in July 2026. The only mitigation available right now is a Kubernetes NetworkPolicy restricting repo-server and Redis ingress to the four legitimate Argo CD components — but only if your CNI actually enforces policies (Flannel doesn't). Scope Argo CD's RBAC away from cluster-admin and keep secrets out of the repo-server environment while you wait. [Read more](https://daily.dev/posts/iKs2KOCVy) ## Hugging Face breached by autonomous AI agent exploiting dataset pipeline RCE Hugging Face disclosed that an attacker used an autonomous AI agent framework — running tens of thousands of actions across short-lived sandboxes — to exploit a remote-code dataset loader and a template-injection flaw, escalate to node-level privileges, harvest cloud credentials, and move laterally across internal clusters. No public model or dataset tampering was found. The incident exposed a practical asymmetry that's worth sitting with: defenders trying to analyze 17,000+ attacker events couldn't submit real attack payloads to hosted commercial models due to safety guardrails, so forensics had to run on a self-hosted open-weight model. The takeaway isn't just "rotate your tokens" — it's that your data and model ingestion surface is a first-class attack surface, and you need a capable self-hosted model ready before an incident, not during one. [Read more](https://daily.dev/posts/BRUsPYJN9) ## Modal scales to 1 million concurrent sandboxes, median start time under 500ms Modal rebuilt its sandbox platform from scratch to eliminate the central coordination bottleneck. The old architecture had a centralized scheduler and durable datastore; the new one uses a fleet of scheduling servers with in-memory cached worker state published via Redis streams, workers as their own source of truth, and sandbox creation requiring only two network hops. All O(sandboxes) and O(nodes) operations are now horizontally scalable. Median sandbox start time is under 500ms, and the system can reach 1 million concurrent sandboxes in under a minute. They traded Kubernetes-style strong consistency for performance — a reasonable call at this scale. Currently in beta. [Read more](https://daily.dev/posts/sxSiXg1Ry) ## OpenTelemetry Go compile-time instrumentation hits v1 The otelc tool hooks into the Go toolchain via -toolexec and injects OpenTelemetry traces and metrics at build time with no source code changes required. It covers net/http, database/sql, gRPC, Redis, and Go runtime metrics, and works on third-party libraries and the standard library alike. Swapping go build for otelc go build is the entire migration. Built collaboratively by Alibaba and Datadog under the OpenTelemetry SIG. This closes a real gap — Go shops have been stuck choosing between manual instrumentation and eBPF agents, neither of which is great. Future plans include broader library coverage and registry-based discovery. [Read more](https://daily.dev/posts/Sf7b5uNcy) --- ## Also notable - **Kimi K3: first 2.8T-parameter open model, weights dropping July 27:** Moonshot AI released Kimi K3, a 2.8-trillion-parameter MoE model (16 of 896 experts active) with a 1M-token context window, claiming ~2.5x better scaling efficiency than its predecessor; full weights release is July 27, 2026, with API pricing at $0.30–$15.00/MTok. [Read more](https://daily.dev/posts/lMuAelJPK) - **Shopify requires mTLS on card-deposit endpoint by October 15, 2026:** Apps using GraphQL Admin API vault mutations to deposit cardholder data must obtain a Shopify-issued certificate and present it on every call by October 15, 2026, or new cardholder data deposits will be blocked. [Read more](https://daily.dev/posts/QPg2m8GwF) - **Istio 1.30.3 fixes GitOps-triggered XDS storm and ambient CNI deadlock:** Istio 1.30.3 patches a regression where metadata-only VirtualService changes from tools like Argo CD triggered unnecessary XDS pushes to all proxies, causing high control plane CPU, plus a deadlock in the ambient CNI node agent during concurrent pod deletion and ztunnel reconnection. [Read more](https://daily.dev/posts/gKO21nydQ) - **Spock 6 Beta: pgEdge multi-master replication moves progress tracking to shared memory:** Spock 6 for PostgreSQL 16–19 moves replication progress tracking from a catalog table to shared memory (reducing I/O contention and bloat), adds spill-to-disk for oversized replay queues, and introduces per-subscription conflict statistics via PG18's pgstat infrastructure, with breaking changes to lag_tracker columns and conflict type names. [Read more](https://daily.dev/posts/aLOFpXgFN) - **Yelp migrated 500+ packages from apollo-tooling to GraphQL Codegen, upstreamed fixes to v6.0.0:** Yelp's transparent migration strategy — matching apollo-tooling's output format exactly rather than adopting Codegen defaults — required forking and patching plugins to fix a concurrency issue in large monorepos, with those fixes ultimately merged into the official GraphQL Codegen v6.0.0 release. [Read more](https://daily.dev/posts/HMm67XpHW) ## Similar posts on daily.dev - [Caught in the Octopus Trap: Inside the Unpatched ArgoCD RCE that Leads to K8S Cluster Takeover](https://daily.dev/posts/caught-in-the-octopus-trap-inside-the-unpatched-argocd-rce-that-leads-to-k8s-cluster-takeover-rilcosgn9) · Medium · 3 upvotes · 0 comments - [Security Flaw in Argo CD Can Let Attackers Take Over Kubernetes Clusters](https://daily.dev/posts/security-flaw-in-argo-cd-can-let-attackers-take-over-kubernetes-clusters-kb2oeqmx0) · Container Journal · 11 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#kubernetes](https://daily.dev/tags/kubernetes), [#golang](https://daily.dev/tags/golang), [#opentelemetry](https://daily.dev/tags/opentelemetry), [#argocd](https://daily.dev/tags/argocd) [View this post on daily.dev](https://daily.dev/posts/argo-cd-rce-still-unpatched-hugging-face-breached-by-autonomous-ai-agent-lqbhd84oi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/argo-cd-rce-still-unpatched-hugging-face-breached-by-autonomous-ai-agent-lqbhd84oi","headline":"Argo CD RCE still unpatched, Hugging Face breached by autonomous AI agent","text":"An unauthenticated RCE in Argo CD's repo-server remains unpatched as of July 2026, with the default Helm chart still shipping without network policies — full cluster takeover is a single crafted gRPC call away. Separately, Hugging Face disclosed a breach where an autonomous AI agent framework exploited code-execution flaws in their dataset pipeline, harvested cloud credentials, and moved laterally across internal clusters. Modal rebuilt its sandbox scheduler to hit 1 million concurrent sandboxes in under a minute, with median start times under 500ms. OpenTelemetry Go finally ships compile-time auto-instrumentation at v1, closing a long-standing gap for Go shops that didn't want to touch eBPF agents.","url":"https://daily.dev/posts/argo-cd-rce-still-unpatched-hugging-face-breached-by-autonomous-ai-agent-lqbhd84oi","datePublished":"2026-07-17T04:18:45.216Z","dateModified":"2026-07-17T04:19:08.118Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"Argo CD RCE still unpatched, Hugging Face breached by autonomous AI agent"}]} ```