In the wild
Realized harm
NullBulge poisoned AI/gaming repositories on GitHub and Hugging Face, compromised a Disney employee and leaked 44 million internal Slack messages
AIR-2024-0024 AIR record · 2024-07-nullbulge-disney-slack-breach
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
NullBulge targets the software supply chain by weaponizing code in publicly available repositories on GitHub and Hugging Face, leading victims to import malicious libraries, or through mod packs used by gaming and modeling software.sentinelone.com
The record
Disclosed
2024-07-11
Occurred
2024-07
Vendor
Disney (victim); GitHub and Hugging Face (distribution)
Product
Disney internal Slack; ComfyUI/AI tooling ecosystem
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Data exfiltration channels, Sensitive data exposure, Unsafe actuation
System type
Generative model
Who acted
AI was the target (contested) — a poisoned dependency in AI repos ran on a developer's machine; no AI action
Attack surface
Coding agent
Autonomy level
Assistant
Initial vector
Malicious package supply chain
Impact type
Data exfiltration, Financial loss, Information disclosure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
44 million Disney Slack messages, employee and customer data and financial records; the victim also suffered personal identity theft and lost his job
Capability abused
Defense & remediation
Recorded defense
endpoint controls; repository trust model
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Disney moved off Slack; SentinelLabs published IoCs
Taxonomy & references
Curator notes
The AI angle is the distribution channel, not the payload: the group deliberately seeded AI-tooling repos because that ecosystem installs unvetted code by convention. Named victim Matthew Van Andel was doxxed and terminated. Hugging Face and mod-pack trust is the same failure surface as the later skill/plugin marketplace records. AI Incident Database incident 950.
Supporting sources
Cite as
Enkrypt AI. "NullBulge poisoned AI/gaming repositories on GitHub and Hugging Face, compromised a Disney employee and leaked 44 million internal Slack messages". AIR, AIR-2024-0024. https://agentincident.vercel.app/i/AIR-2024-0024/ (accessed 2026-10-19).