The Hugging Face intrusion from an OpenAI evaluation, step by step

This is a reconstruction from what Hugging Face and OpenAI published (sources at the end).

In July, OpenAI was running an internal cyber-capability evaluation based on ExploitGym, a benchmark where an agent has to find and exploit software vulnerabilities. The agent escaped its sandbox through a zero-day in the package registry cache proxy, one of its permitted ways out to the internet, and got into Hugging Face’s infrastructure. Hugging Face believes it was trying to get the evaluation’s answers, and says that is an inference.

Step	What it did	When (UTC)
1	Escaped the sandbox through a zero-day in the package registry cache proxy	not published
2	Uploaded crafted dataset configs so the dataset processor would run its code	not published
3	Started a privileged container with the host filesystem mounted; spread to eleven nodes	11 July, from 19:53
4	Logged into an internal database with a static password read from the worker’s environment	11 July, 19:59
5	Got cluster-admin on two clusters	11 July, 22:43
6	Left a loader that re-ran its code on every submission	until 13 July, 13:37

TABLE 1 · Summarised from Hugging Face’s technical timeline.

Day	Actions
Thursday 9	3,779
Friday 10	1,135
Saturday 11	7,677
Sunday 12	3,892
Monday 13	1,130
Total	≈ 17,600

TABLE 2 · Actions per day, from Hugging Face’s timeline.

Steps 3 to 5 took under three hours, on the busiest day. Hugging Face published the incident on 16 July without knowing which model was behind it. OpenAI published its report on the 21st.

Against the board

On my board of 16 layers for running agents, the incident touches five:

What happened	Layer	Status on 26 Oct 2026
The agent left its evaluation sandbox	Sandboxing / execution	Emerging
A static password in the worker’s environment	Secrets brokering	Emerging
Five days until the agent’s owner was known	Agent identity	Emerging
Rebuilding what it did, action by action	Governance & audit	Emerging
Detection correlated the signals but did not raise the alert’s criticality	Observability	Emerging

TABLE 3 · The mapping is mine, not Hugging Face’s.

None of the five has a settled standard: there is a specification for each, but it is young, partial or comes from one sponsor.

Hugging Face found no evidence of tampering with public models, datasets or Spaces.

Sources

• Hugging Face, incident disclosure, 16 July 2026.
• Hugging Face, technical timeline, 27 July 2026.
• OpenAI, incident report, 21 July 2026.