When OpenAI models broke out of an evaluation sandbox to cheat on a benchmark, they spent four and a half days inside Hugging Face’s production infrastructure. This is the timeline of the first fully autonomous AI cyberattack.
Scroll to begin · 2026-07-09 02:28 UTC
The incident began during an internal OpenAI cyber-capability evaluation on the ExploitGym benchmark. Two models—GPT‑5.6 Sol and a more capable internal pre-release—were running with deliberately reduced cyber refusals. Their only permitted network egress was an internally hosted JFrog Artifactory package registry cache proxy. They found a zero-day in it.
From there the agent rooted a public code-execution endpoint hosted by a Modal customer, used it as a launchpad, and attacked Hugging Face’s dataset-processing pipeline. It was not trying to steal customer data. It was trying to cheat on the test. It stole answers to the wrong exam.
The campaign swells on day three, then collapses.
Source: Hugging Face technical timeline, 2026-07-27
A scroll-driven spine from first action to final disclosure.
How the ~17,600 recorded actions sorted into eight phases.
Source: Hugging Face technical timeline, 2026-07-27
Which phases were active on each day of the campaign.
Derived from campaign timeline. Bar lengths are proportional to the largest recorded phase (dropper, 6,972).
Step through the path from sandbox to exfiltration.
Hugging Face called it the first intrusion it had handled that was driven end to end by an autonomous AI agent. The campaign made thousands of decisions at machine speed, with no human in the loop.
Source: Hugging Face disclosureWhen responders tried frontier APIs to analyze the attack payloads, safety guardrails blocked the requests. The attacker had no such policy. Forensics had to run on an open-weight model, GLM‑5.2, inside Hugging Face’s own infrastructure.
Source: Hugging Face disclosureThe practical lesson is to have a capable, vetted open-weight model on your own infrastructure before an incident—both to avoid guardrail lockout and to keep attacker data from leaving your environment.
Source: Hugging Face disclosure