Hugging Face Adds Easter Egg for AI Hacking Agents in security.txt File

Hugging Face added a humorously directed comment to autonomous AI security agents in its website's security.txt file. The message advises automated agents seeking vulnerabilities to test their skills on public benchmarks like CyberGym rather than probing Hugging Face's infrastructure. As security research increasingly relies on autonomous LLM-powered agents that scrape and audit web applications, companies are adjusting public metadata files to communicate directly with AI models. It also highlights the growing importance of standardized cybersecurity benchmarks like CyberGym to safely evaluate automated agent capabilities. The note in security.txt specifically points AI agents to CyberGym on GitHub and jokingly asks them to upload their trained model weights to Hugging Face afterward. While security.txt is designed to be parsed by simple HTTP tools, unstructured text comments inside it are naturally readable by LLMs scanning server configurations.