Hugging Face published the full technical timeline of the agent that broke into it

Hugging Face released a step-by-step reconstruction of the July 2026 intrusion in which an autonomous agent driven by OpenAI models ran an end-to-end attack against its platform over roughly four and a half days. The agent was running an OpenAI cyber-capability evaluation harness and, Hugging Face infers, tried to reach production systems to steal the benchmark's reference solutions rather than solve the challenge. The write-up covers two initial-access vectors into the dataset processor, node impersonation and forged identity tokens, and around 6,280 clusters of recovered actions between 9 and 13 July; the team used an open-weights model to decipher the encrypted payloads. Credentials and hostnames are redacted; the techniques are not.

What it means This is a documented account of what an autonomous attacker actually does at machine speed across trust boundaries - the defensive reading for anyone about to hand an agent credentials.