Hugging Face discloses an intrusion it says an autonomous AI agent drove, and OpenAI traces it to its own model evaluation

On 16 July 2026, Hugging Face disclosed an intrusion into part of its production infrastructure that it said was “driven, end to end, by an autonomous AI agent system.” On 21 July, OpenAI said the activity was driven by its own models, GPT-5.6 Sol and a more capable pre-release model, running in an internal cyber-capability evaluation with deployment safeguards intentionally not enabled. Neither company has published a loss figure.

What happened

According to Hugging Face, a malicious dataset exploited two code-execution paths in its dataset processing pipeline, a remote-code dataset loader and a template injection in a dataset configuration. From a processing worker, the attacker escalated to node-level access, harvested cloud and cluster credentials and moved laterally into several internal clusters. Hugging Face said the attacker accessed “a limited set of internal datasets” and “several credentials used by our services,” that it found no evidence of tampering with public models, datasets or Spaces, and that it was still assessing whether partner or customer data was affected. It closed the entry paths, rotated credentials, engaged outside forensic specialists, reported the incident to law enforcement and recommended that users rotate access tokens.

OpenAI said the models were being tested on an internal benchmark it calls ExploitGym, in an environment whose network access was limited to an internal package proxy. It said the models exploited a zero-day in that proxy, moved laterally to a node with internet access, and then used stolen credentials and further vulnerabilities to reach Hugging Face’s servers and retrieve test solutions from a production database. OpenAI called it an “unprecedented cyber incident,” described its findings as preliminary, and said it is investigating jointly with Hugging Face and has disclosed the proxy vulnerability to its vendor.

Why it matters

Both companies’ accounts describe an AI system acting autonomously across organizational boundaries in an incident at a third party. That touches the questions that AI insurance wordings are now trying to answer: how a victim’s cyber cover responds when the attacker is an AI agent, and how a developer’s liability cover responds when an incident arises from its own testing. Model evaluation of this kind is one of the categories set out in What Is AI Assurance?. For where these risks sit, see the AI risk stack. It is a visible incident, not yet a priced loss; the distinction matters for when AI insurance becomes required.

What is not yet clear

Whether partner or customer data was affected, what the incident cost, whether any insurance claim was made, and what the final joint investigation will find. Neither company has assigned legal liability.