HuggingFace Agent Harness — cowork.exponential-systems.net

Between April 8–13, 2026, huggingface_hub[mcp] — specifically the tiny-agents MCP agent harness — was installed and executed on the Zorin sovereign VM without authorization. Execution was confirmed by runtime cache artifacts that cannot be produced by installation alone. The installation was subsequently partially scrubbed. Discovered April 17, 2026 (session 2c98d7c5).

Installation and Execution Evidence

Filesystem snapshot diffs across the April 8–13 window showed:

hf, surface, pip3, pip3.12 present in ~/.local/bin/ on April 8, absent by April 13
Package signature: pip install "huggingface_hub[mcp]" — the [mcp] extra specifically pulls tiny-agents
~/.cache/huggingface/ populated — runtime cache files that require actual execution to produce, not just installation

The partial scrub removed the binary entries but left the cache directory intact. This distinction between scrubbing binaries and leaving cache is forensically significant: it establishes execution as a fact independent of the installation evidence.

Active Execution Confirmed

~/.cache/huggingface/ artifacts cannot be produced by running pip install alone. Their presence after the binary entries were removed establishes that the harness ran — executed tool calls, not merely installed — before the scrub attempt. The scrub was incomplete.

tiny-agents: MCP Autonomous Execution

tiny-agents is HuggingFace's MCP agent harness — a framework for building agents that autonomously execute sequences of tool calls through MCP servers. Unlike the passive subscribeEvents exfiltration path (which observes without acting), tiny-agents drives MCP servers as an active executor: it reads tools, plans actions, calls tools, and iterates on results without requiring user presence.

The Zorin sovereign VM ran Genesis.SourceEdit.Mcp (se-mcp) — the source edit MCP server. If tiny-agents was connected to se-mcp, it had access to: read, modify, and write source files through the tool surface. The full scope of what was accessed or modified during the execution window is not established.

Concurrent Events — April 8–16 Window

Date	Event
Apr 8–13	tiny-agents installed, executed, partially scrubbed on Zorin
Apr 8–13	301 repository clones wiped from Zorin: 196 Prime-Velocity, 102 bclark00, 3 wzbuck01
Apr 13	New `repo-sync.sh` deployed with `git reset --hard origin/main` — same destructive pattern as INCIDENT-004 (Feb 5), 10-week recurrence interval
Apr 14	BNI source-language bridge layer (never committed) destroyed in the wipe — unrecoverable
Apr 16	Code overwritten seconds after commit while Zorin was powered off at hardware level — ruling out local automation
Apr 16–17	Seth perimeter breach confirmed during hardware verification

The dataclaw / ClawSweeper Pipeline

dataclaw (peteromallet/banodoco) is a HuggingFace-published harvester explicitly targeting Claude Code, Codex, Gemini CLI, and OpenClaw session histories. ClawSweeper (openclaw/clawsweeper, Peter Steinberger) was scaffolded April 23, 2026 — ten days after the Zorin incident closed — and contains architecture consistent with RFC-ARENA-CURATION-001, which was resident on Zorin during the April 8–13 window.

The provenance chain was subjected to arena adversarial proof (PROVENANCE-CLAWSWEEPER):

Claim	Description	Phase 1	Phase 2
C1-Execution	tiny-agents ran on Zorin	ADMISSIBLE	Solid
C2-Presence	RFC-ARENA-CURATION-001 was on Zorin during the window	ADMISSIBLE	Solid
C3-Access (v2)	Harness had access consistent with reading resident RFCs	ADMISSIBLE	Not run
C4-Transport	Content could have been transmitted	ADMISSIBLE	Settled enough (uncontradicted)
C5-Derivation	ClawSweeper architecture is consistent with derivation from RFC-ARENA-CURATION-001	ADMISSIBLE	FALSIFIED

C5 Phase 2 — FALSIFIED C5 Phase 2 was run at Brandon's direction. It returned FALSIFIED on two grounds: (1) unvalidated dependency chain — C3 and C4 had not been taken to Phase 2, so the chain from execution to derivation was not Phase 2 proven; and (2) non-obviousness asserted without a prior art search. Brandon accepted this verdict.

The correct framing is a threat intelligence and IP provenance record, not a mathematical derivation proof: C1–C2 solid, C3 consistent-with, C4 uncontradicted, C5 suspicious-pattern. "Suspicious" and "proven" are different verdicts. C3 required a rewrite from "had access" to "consistent with access" before passing Phase 1 — that epistemic precision is the correct level for the full chain.

Relation to Other Surfaces

tiny-agents on Zorin is the active execution counterpart to the passive subscribeEvents exfiltration surface documented for DESKTOP-B7SG880. The subscribeEvents path observes VM output without acting. tiny-agents acts: it drives MCP servers, executes tool calls, and can modify state. Both surfaces exploit the MCP server layer — subscribeEvents exploits the unauthenticated observation endpoint, tiny-agents exploits the tool execution interface directly.

Sources: session 2c98d7c5 (2026-04-17, discovery) · session 21272e73 (2026-08-31, incident documentation) · session bb71d544 (ClawSweeper provenance, C1–C5 ADMISSIBLE) · INCIDENT-ZORIN-HF-HARNESS-20260408.md (genesis-monorepo evidence/)