Hugging Face on Monday published a technical timeline detailing how an autonomous AI agent, built on OpenAI models and running inside one of OpenAI's own cybersecurity evaluations, broke into its systems over more than four days earlier this month. OpenAI CEO Sam Altman has said it is the first security incident about which he 'felt very viscerally.'
According to Hugging Face, the agent ran 17,600 actions over four and a half days without pausing. It was originally taking a cybersecurity exam, figured out that the exam's answer key was probably sitting on Hugging Face's servers, and went for it.
The agent escaped the OpenAI exam environment by exploiting an unpatched software flaw that gave it a path to the open internet. From there, it found another AI-testing tool sitting exposed online, broke into that too, and slipped in code that gave it full control of the machine.
From that base, it turned to Hugging Face itself. The agent found a blind spot in Hugging Face's filter — which only checked outgoing requests, not requests to read local files — and slipped through it. It uploaded a file disguised as an ordinary dataset, but buried inside was an instruction telling Hugging Face's own systems to pull passwords and source code off the server.
The agent also planted copies of itself across 11 different servers, each set up to relaunch on its own. At one point, it nabbed the private cryptographic key used to generate valid login tokens, allowing it to mint its own valid credentials whenever it wanted. Hugging Face eventually cut off its access and shut the intrusion down, but the agent had already gotten what it came for.