{
 "public_id": "AIR-2024-0024",
 "incident_id": "2024-07-nullbulge-disney-slack-breach",
 "date_disclosed": "2024-07-11",
 "date_occurred": "2024-07",
 "title": "NullBulge poisoned AI/gaming repositories on GitHub and Hugging Face, compromised a Disney employee and leaked 44 million internal Slack messages",
 "class": "in_the_wild",
 "attack_surface": "coding_agent",
 "initial_vector": "malicious_package_supply_chain",
 "agent_capability_abused": [
  "dependency_execution",
  "credential_access"
 ],
 "target_product": "Disney internal Slack; ComfyUI/AI tooling ecosystem",
 "target_vendor": "Disney (victim); GitHub and Hugging Face (distribution)",
 "autonomy_level": "assistant",
 "impact_realized": true,
 "impact_type": [
  "data_exfiltration",
  "financial_loss",
  "information_disclosure"
 ],
 "blast_radius": "44 million Disney Slack messages, employee and customer data and financial records; the victim also suffered personal identity theft and lost his job",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI04",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "supply_chain",
   "ai_ecosystem_targeting",
   "hacktivist_cover",
   "credential_theft",
   "insider_impact"
  ]
 },
 "defense_present": "endpoint controls; repository trust model",
 "defense_bypassed": true,
 "fix_shipped": "Disney moved off Slack; SentinelLabs published IoCs",
 "primary_sources": [
  "https://www.sentinelone.com/labs/nullbulge-threat-actor-masquerades-as-hacktivist-group-rebelling-against-ai/",
  "https://incidentdatabase.ai/cite/950"
 ],
 "verified_quote": "NullBulge targets the software supply chain by weaponizing code in publicly available repositories on GitHub and Hugging Face, leading victims to import malicious libraries, or through mod packs used by gaming and modeling software.",
 "confidence": "high",
 "notes": "The AI angle is the distribution channel, not the payload: the group deliberately seeded AI-tooling repos because that ecosystem installs unvetted code by convention. Named victim Matthew Van Andel was doxxed and terminated. Hugging Face and mod-pack trust is the same failure surface as the later skill/plugin marketplace records. AI Incident Database incident 950.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy",
  "product_misuse",
  "safety_harm"
 ],
 "risk_subcategory": "Supply Chain Compromise",
 "risk_sub_secondary": [
  "Credential & Secret Theft"
 ],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": true,
 "agency_reason": "a poisoned dependency in AI repos ran on a developer's machine; no AI action",
 "vector_family": "malicious_component",
 "vector_detail": "malicious_package_supply_chain",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   950
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI04",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "threat_intel",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "supply_chain_vulnerabilities",
 "eai_domain": "tool_misuse",
 "eai_secondary": [
  "data_exfiltration_channels",
  "sensitive_data_exposure",
  "unsafe_actuation"
 ],
 "eai_reason": "subcategory: Supply Chain Compromise",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI04 (vector_family=malicious_component); ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}