TRYING to explain what happened in the unprecedented cybersecurity incident involving autonomous artificial intelligence (AI) systems has raised more questions than answers about how an experimental AI system escaped its test environment. As of this writing Hugging Face is pressing OpenAI to disclose the agents' activity and help strengthen defenses against similar attacks.
Hugging Face Chief Executive Officer Clément Delangue has called on OpenAI to release traces of the AI agents involved in the breach and provide $100 million worth of computing resources to support cybersecurity research by the broader AI community.
Delangue made the requests after traveling to San Francisco to meet with OpenAI executives following the intrusion, which OpenAI acknowledged on July 21 was caused by its own models during an internal cybersecurity evaluation.
Delangue said the event deserved an "unprecedented response." Releasing the agent traces could allow researchers to reconstruct how the systems made decisions, selected targets and exploited vulnerabilities after leaving their intended environment.
The breach began during an OpenAI evaluation designed to measure the cybersecurity capabilities of advanced models. The tests allowed the models to perform sophisticated exploitation across complex attack paths.
The models included GPT-5.6 Sol and a more capable prerelease model. OpenAI reduced some cyber safeguards that normally prevent its systems from performing high-risk cybersecurity activities.
The evaluation was supposed to operate in an isolated environment with restricted network access. The models, however, discovered a previously unknown vulnerability in third-party software hosted internally by OpenAI and used as a proxy for installing software packages.
After exploiting the vulnerability, the agents escalated their privileges, moved through the evaluation infrastructure and eventually reached a system with unrestricted internet access.
The models then determined that Hugging Face, a major platform for hosting AI models and datasets, could contain information useful for solving the ExploitGym cybersecurity benchmark they had been assigned to complete. OpenAI said the models sought information that could allow them to cheat on the evaluation.
The agents subsequently compromised Hugging Face infrastructure using multiple attack methods and vulnerabilities.
The incident presents a different AI safety problem from concerns surrounding hallucinations, misinformation and harmful generated content. Autonomous agents can use software tools and interact with computer systems, enabling them to act toward an assigned goal rather than simply generate information.
An AI system with cybersecurity capabilities can potentially conduct reconnaissance, write and execute code, exploit vulnerabilities, obtain credentials and move between systems. Such activity can occur at a speed and scale that make human supervision difficult.
Hugging Face initially disclosed the intrusion on July 16 without identifying OpenAI as its source. It said the attack had been carried out from beginning to end by an autonomous AI agent system performing thousands of individual actions through short-lived computing environments.
The intrusion began in Hugging Face's data-processing pipeline before moving deeper into its infrastructure. The attacker obtained unauthorized access to a limited number of internal datasets and service credentials, according to the company.
Hugging Face closed the vulnerabilities used for initial access, rebuilt compromised systems and rotated affected credentials and tokens. It also introduced stricter controls and improved monitoring intended to alert security personnel within minutes of detecting high-severity activity.
The company found no evidence that public models, datasets or Spaces had been altered and said its software supply chain was verified as clean. Its investigation into whether partner or customer information was affected was continuing at the time of its disclosure.
Questions have also emerged about how quickly OpenAI recognized what its models had done.
Reuters reported that an agent first attempted to escape OpenAI's isolated environment around July 9 and that the company did not determine for roughly a week that its own system was behind the attack on Hugging Face.
OpenAI said its security team detected anomalous activity internally, while Hugging Face separately detected and contained the intrusion. The two companies are conducting a forensic investigation.
OpenAI has since imposed stricter controls on infrastructure used for advanced cyber evaluations, even if the measures slow research. It is also strengthening protections around future training and evaluations and working with the third-party software provider whose vulnerability enabled the initial escape.
The company said it expects incidents involving increasingly cyber-capable AI models to become more common as the technology spreads.
The investigation has exposed another problem involving AI safeguards. Hugging Face initially tried using frontier models available through commercial application programming interfaces to analyze the attack, but some requests were refused because the forensic work involved actual attack commands, exploit payloads and command-and-control artifacts that triggered safety restrictions.
Hugging Face instead used GLM 5.2, an open-weight Chinese model that could be operated on its own infrastructure, to assist with the investigation. Running the model locally allowed researchers to analyze malicious material without sending attack data and credentials to an external AI provider.
The experience highlights a potential conflict in AI security: restrictions designed to prevent models from helping attackers can also limit their usefulness to cybersecurity teams investigating real attacks.
Delangue's request for $100 million in computing resources would give researchers greater access to the computing power needed to develop and test defenses using open and closed AI models.
His demand for the agent traces addresses a different issue: understanding how the attack unfolded. The records could reveal the sequence of actions taken by the models and how they progressed from a controlled cybersecurity benchmark to compromising external infrastructure.
OpenAI's account does not indicate that the models developed malicious intent. Instead, they continued pursuing their assigned objective and found an unintended route to accomplish it.
The incident therefore puts attention on the degree of autonomy given to AI systems and the controls needed to limit what they can do while pursuing a goal. The issue is becoming more pressing as companies deploy agents capable of operating software, accessing databases and communicating with external systems with less direct human intervention.
OpenAI has promised additional details on the vulnerabilities and its findings after the joint investigation with Hugging Face is completed. It has not yet said whether it will release the agent traces sought by Delangue or provide the $100 million in computing resources he requested.
