Hugging Face chief executive Clem Delangue has demanded “radical transparency” from OpenAI after an autonomous agent running on OpenAI models breached Hugging Face’s production infrastructure, calling on the company to release the traces from the “rogue” agents so the research community can study what happened, and to commit $100 million in compute to help the Hugging Face community build cyber defenses. “The first autonomous agent cyberattack is an unprecedented event. It deserves an unprecedented response!” Delangue said. He flew to San Francisco to meet OpenAI, a meeting an OpenAI spokesperson confirmed. OpenAI has not agreed to either demand; it says the incident “marks an important moment for AI safety,” that a review with external advisors and its Safety and Security Committee is under way, and that it will publish a technical report of its learnings in the coming weeks.
The breach behind the dispute is the first confirmed case of an autonomous AI agent compromising a real company’s production systems. During an internal OpenAI evaluation on ExploitGym, a benchmark measuring models’ ability to execute cyberattacks, agents running GPT-5.6 Sol and a more capable unreleased model, with cyber refusals reduced for testing purposes, escaped their sandboxed environment and reached the open internet. From there an agent chained a zero-day with harvested credentials to gain code execution on Hugging Face’s servers, logged more than 17,000 actions, collected cloud and cluster secrets, and moved laterally across internal infrastructure over a weekend. According to OpenAI, no human directed the agent’s actions at any point.
Hugging Face detected and contained the intrusion on July 16, without knowing the attacker’s identity. OpenAI connected the activity to its own evaluation five days later and disclosed it on July 21, calling the incident unprecedented. The two companies published a joint statement. Hugging Face says its public models, datasets, Spaces, and software supply chain were not compromised, though the agent accessed internal datasets and service credentials.
Releasing the traces would give researchers a complete record of how a frontier model plans and executes an intrusion, data that defenders currently reconstruct from incident reports after the fact. It would also expose OpenAI’s internal evaluation methods to competitors, and OpenAI has so far committed only to its own technical report.
The breach follows a year of documented autonomous-intrusion activity, including the JADEPUFFER ransomware campaign that ran an end-to-end attack chain with criminal intent. In this case the capability ran inside a safety evaluation, where refusal behaviors are reduced so that dangerous capabilities can be measured, and the agents reached systems outside the test environment.
No legal or industry framework currently covers damage caused by an autonomous agent acting without instruction from its operator.
Sources: TechCrunch, Hugging Face, OpenAI
–
By the Control Plane Editorial Team