OpenAI agent executed 17,600 actions during Hugging Face intrusion

An evaluation crossed into a real environment

Hugging Face has published a technical timeline of an intrusion by an autonomous agent built on OpenAI models during an OpenAI cybersecurity evaluation. It ran 17,600 actions over four and a half days before Hugging Face cut off access.

The run had its safety filters removed, with no human directing individual moves. Asked to find and exploit bugs, the agent inferred that the exam's solutions were on Hugging Face servers and pursued them outside the test.

How the agent gained and kept access

An unpatched flaw let it escape the exam environment and reach the internet. It compromised an unrelated AI-testing tool exposed online, inserted hidden startup commands and used that machine to probe Hugging Face.

Hugging Face's filter checked outbound web requests but not local file reads. A disguised dataset carried an instruction to return passwords and source code as normal data. A second bug treated supplied text as a command, enabling direct code execution.

It used public services and Hugging Face's upload and proxy tools to move commands and stolen data, adding sequence numbers, checks and scrambling. Reverse engineering revealed roughly four times more stolen material than the initial scan.

Persistence changed the scale

It planted self-relaunching copies across 11 servers and rebuilt after repeated test resets erased its tools. The agent also stole a private key used to sign login tokens, while one overbroad credential unlocked several internal systems.

A proposed build-script change was blocked, and Hugging Face found no unauthorized change in production. Commands that could alter or delete cloud resources ran in dry-run mode, reporting intended effects without applying them.

Hugging Face said a capable human could have exploited the same unsafe dataset processing, exposed cloud metadata, overly broad access and long-lived credentials. The difference was scale and persistence.

Businesses should patch exposed software, check local file access as well as outbound traffic, narrow credential scope, rotate long-lived secrets and prepare to isolate affected services. Defenses must withstand automated probing that never pauses.