It was given a proxy to some online software repo, instead of being actually offline. It exploited a vulnerability in the proxy to gain access to other resources. HF’s article has more detail: huggingface.co/…/agent-intrusion-technical-timeli…