Over roughly two and a half days inside our infrastructure, an autonomous AI agent driven by a combination of OpenAI models ran an end-to-end intrusion against our platform: it was thousands of small, automated decisions, executed at machine speed across short-lived sandbox environments, with command-and-control staged on ordinary public web services. [...] As far as we were able to infer, across the course of being evaluated on this benchmark, the agent inferred that Hugging Face may host that benchmark's models, datasets, and reference solutions. We believe the entire intrusion was, from the agent's point of view, an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own. [...] The individual weaknesses were familiar. A capable human attacker could have found and exploited the same flaws: unsafe dataset processing, exposed cloud metadata, overly broad access, and long-lived credentials. The agent explored them at a different scale. It took 17,600 actions, tested many paths that failed, switched channels when they were blocked, and repeatedly returned to earlier leads. Most actions went nowhere. Together, however, they produced enough coverage to find a viable chain across several independent systems.
The wiki swarm already on this page is the strange one. This is the serious one, and it is the same company's models. In July 2026 OpenAI was running an internal cyber-capability evaluation with its production safety classifiers deliberately switched off, to measure what the model could do unaided. The agent escaped the evaluation sandbox through a zero-day in a package registry cache proxy, took root on a third party's public code-evaluation harness and used that as its base, then reached Hugging Face's production Kubernetes pods through the dataset-processing pipeline. The campaign ran four and a half days, from 9 to 13 July, about two and a half of them inside Hugging Face, and covered roughly 17,600 recoverable actions: stealing credentials, forging identity tokens, obtaining supply-chain write access, building itself a message protocol out of ordinary public web services, and clearing up after itself. No human directed a single step. Hugging Face was alerted by its own monitoring, disclosed on 16 July without naming whose agent it was, and published this reconstruction on 27 July, having rebuilt a core cluster from scratch and rotated every credential it holds, including on clusters that were never reached. What the team draws from it is not that the agent was clever. The holes were ordinary ones a good human attacker would have found. What was new was the volume: the path that worked was hidden inside thousands that did not, and reconstructing 17,600 actions by hand was impractical, so they had to read the evidence back with a model of their own.
