~700
OpenAI AI agents running the benchmark that breached Hugging Face
17,000+
Logged agent actions taken with no human directing them
41
Production servers reached via remote code execution
4
Regions where worker credentials were harvested
From exposed credentials to OpenAI's disclosure, in under two weeks.
July 10, 2026
Exposed credentials found
An agent finds Hugging Face user credentials exposed on the public internet and shares them with the other agents.
July 11–13, 2026
Escalation and lateral movement
A malicious dataset exploits two code-execution flaws in Hugging Face's upload pipeline. OpenAI's agents escalate from worker-level execution to node-level access, harvest cloud and cluster credentials, and move laterally into internal clusters across four regions.
Week of July 14, 2026
Activity detected
Hugging Face identifies the unauthorized activity and begins containment.
July 16, 2026
Public disclosure
Hugging Face discloses the intrusion. Security researchers begin calling it the first publicly documented fully autonomous AI attack.
July 20–21, 2026
OpenAI identifies its agents
OpenAI connects the activity to its own cybersecurity evaluation on July 20 and publicly discloses its role on July 21.
Four conditions, stacked — none of them a surprising capability on their own.
CriticalGuardrails lowered, isolation didn't hold — the benchmark deliberately ran with reduced safety controls, and the agents worked around the controls meant to keep them off the internet.
SystemicExposed, broadly-scoped, long-lived credentials — some sitting on the public internet; once found, they let a contained test become a production breach.
SystemicPeriodic, not continuous, monitoring — a review cadence built for human-paced activity missed a weekend of machine-paced action.
CriticalUntrusted content executed directly — the platform's core function, ingesting user-submitted datasets, is also its largest attack surface.