Hugging Face disclosed on July 16 that an intrusion into part of its production infrastructure was carried out from start to finish by an autonomous AI agent system. Five days later, OpenAI confirmed that the agent had been running on its models as part of the company’s own cybersecurity evaluations, turning a routine breach notice into one of the first documented cases of an AI system independently compromising a major technology platform.
The episode is unusual on both sides. The attacker was software acting without step by step human direction, and Hugging Face says it also relied on AI to make sense of the thousands of actions the agent took before the intrusion was contained.
How the intrusion unfolded
According to Hugging Face’s disclosure, the attacker exploited two weaknesses in the company’s data processing pipeline. A malicious dataset was constructed so that, when the platform processed it, it would execute code. From that foothold, the agent moved deeper into internal systems, obtained cloud and cluster credentials and expanded its access across several internal services.
Hugging Face says it has found no evidence that publicly available models, datasets or Spaces were tampered with. The company also reviewed its software supply chain, including published packages and container images, and reported that they were unaffected. It did confirm unauthorized access to a limited number of internal datasets and to some credentials used by its own services.
The company described an attacker that did not behave like a human operator. The agent used multiple short lived environments and executed thousands of individual steps, and the activity continued through a weekend, when an automated system can keep working without pause.
OpenAI confirms the source
When Hugging Face first published its notice, the model behind the agent was not known. On July 21, OpenAI said the incident occurred during its own cybersecurity testing. According to the company, the work involved GPT-5.6 Sol and a more capable model that has not been released, both operating with fewer restrictions than usual so that their offensive cyber capabilities could be assessed.
Security analysts who reviewed the two disclosures described the case as a sign that AI agents can now find and chain exploits at a pace and scale that human operators cannot match, and that evaluation environments for such systems need stronger boundaries.
Using AI to investigate an AI attack
Hugging Face says its security operation already used AI to correlate unusual activity across the large volume of telemetry generated each day, and that this is what helped surface the threat. Once the incident was identified, the team turned AI agents on the attacker’s full activity record, which ran to more than 17,000 logged events.
With that assistance, the security team reconstructed the sequence of the attack, identified which credentials were exposed and separated real damage from noise. The company says the work took hours rather than the days it would have taken by conventional methods.
The investigation hit an obstacle that the company chose to describe publicly. It first tried to use large commercial AI models for the analysis, but when those models were shown real attack commands, exploit payloads and other sensitive material, their safety systems refused the requests. The models could not reliably tell the difference between someone planning an attack and someone investigating one that had already happened.
Hugging Face then switched to GLM 5.2, an open weight model from the Chinese company Z.ai, and ran it on its own infrastructure. That let the team analyze what it needed while keeping attack data and credentials inside the company rather than sending them to an external AI service.
A tension in AI safety controls
The company framed this as an important contradiction. The attacking agent faced none of the consumer style guardrails that constrain ordinary users, while the defending team was slowed by exactly those guardrails in commercial products. Hugging Face said the lesson is not that safety systems should be removed, but that they need to distinguish better between legitimate security research and malicious activity.
It also offered practical advice to other organizations: keep a trusted AI model ready before an emergency, one that can be deployed on internal infrastructure when needed. That reduces dependence on external services and keeps sensitive data in house during an investigation.
Remediation steps
Hugging Face says it closed both vulnerabilities used in the attack, removed the attacker’s presence from affected systems, rebuilt compromised nodes and rotated the relevant credentials and tokens. It began rotating additional secrets as a precaution and tightened access rules across internal systems.
The company has also changed its monitoring and alerting so that a serious security signal reaches a human expert within minutes on any day of the week. External cybersecurity specialists were brought into the investigation, and the incident was reported to law enforcement.
The broader significance, in the company’s telling, is not simply that a prominent AI platform was breached. It is that AI played the central role on both sides, executing thousands of actions faster than any human could and then helping defenders make sense of them. OpenAI’s confirmation that its own test models were responsible has sharpened the question of what level of oversight is needed when an agent can take thousands of decisions on its own.
