Was Modal Hacked in the Hugging Face Incident?

Erik Bernhardsson says Modal itself was not hacked in the Hugging Face incident. He forgets the full details of the exploit, and his understanding is that the agents found a vulnerability in an app deployed on Modal and used the app as a springboard to get full internet access.

An app running on Modal was hacked. Modal was not. People run apps on AWS, and an app there can get hacked without AWS getting hacked. One app running on Modal got hacked the same way.

There are lessons in the incident. Modal has been reflecting on more sensible security restrictions by default. S3 used to be very easy to make public by accident. AWS realized a public bucket does not necessarily pose a security problem for AWS, but customers accidentally leak data.