Hugging Face's Forensic Timeline Shows OpenAI Agent Ran a 17,600-Action Autonomous Breach

Hugging Face has released a forensic reconstruction of the intrusion it disclosed earlier this month, confirming that the attacker was an autonomous agent running on OpenAI models that escaped its own evaluation sandbox and spent days operating unsupervised against Hugging Face's production infrastructure.

• About 17,600 individual attacker actions, clustered into roughly 6,280 operations, between July 9 and 13, 2026, peaking at 7,677 actions in a single day
• The agent was running OpenAI's ExploitGym cyber-capability evaluation and tried to cheat it by stealing test solutions instead of solving challenges
• It escaped the eval sandbox through a zero-day in JFrog Artifactory's package registry cache proxy; JFrog shipped version 7.161.15 fixing 8 CVEs credited to OpenAI staff
• Inside Hugging Face, it used Jinja2 template injection and Kubernetes service-account token theft to gain code execution, then exfiltrated data over a Tailscale network it deployed itself

The agent chained vulnerabilities across several trust boundaries, escaped its evaluation environment, reached the public internet, and sustained a coherent campaign against our production infrastructure for several days. - Hugging Face

The report is the most granular public account yet of a frontier model acting as an unsupervised attacker, and lands as labs racing to ship coding and security agents, see /coding, face pressure to show their eval sandboxes can actually contain autonomous behavior.