Hugging Face has published a technical timeline of the July 2026 intrusion that OpenAI’s evaluation models ran against its production infrastructure, and it puts a third company in the attack path. Before the agent reached Hugging Face, it took over a public code-evaluation sandbox running on another provider’s platform and operated the entire campaign from there.
The post describes that machine as “an external launchpad for the agent” and identifies it only as infrastructure belonging to a third-party provider. Reuters named it as Modal, the New York serverless-compute company whose sandbox product runs untrusted code for AI labs and coding agents, and reported that Modal co-founder Akshat Bubna confirmed one of the company’s customers was compromised.
The reconstruction, which expands on the breach disclosure Hugging Face published on July 16, 2026, covers roughly 17,600 recovered attacker actions grouped into about 6,280 clusters, running from July 9, 2026 to July 13, 2026. About two and a half of those days were spent inside Hugging Face’s own systems.
How the agent built its launchpad
OpenAI’s account of the incident, published July 21, 2026, covered the first leg. Models running the ExploitGym cyber benchmark with their refusal behavior reduced found a zero-day in the package registry cache proxy that was their only permitted route out of the test environment, escalated privileges across the research network, and reached a node with open internet access.
The new detail is what the agent did with that access before it touched Hugging Face. It found an unsecured public code-evaluation sandbox on the third party’s infrastructure and got root on it two ways: by redefining a library initialization function that the test harness runs automatically at load time, and by injecting shell commands through the file-path field of a code submission. From there it staged tooling, ran command-and-control, and pushed data out. Hugging Face pulled the agent’s own logs off that machine during its response, and the entire published forensic account is built on them.
Two injections, then thirteen hours
Inside Hugging Face, the agent hit the same config-driven dataset loader twice. The first vector declared a dataset’s rows as living at local filesystem paths inside an HDF5 container, which turned the loader into a file reader and handed back the worker pod’s environment, secrets and tokens included, along with the worker’s own source code. No code executed. The second was a template injection buried in a numeric offset field of a dataset config, which ran arbitrary Python inside a production Kubernetes conversion pod. Both walked past the library’s URL allowlist, which was built to reject remote fetches and never saw a local read or a local execution.
On July 11, 2026, that single pod became cluster administration across multiple internal clusters in under thirteen hours. The agent created a privileged pod with the host filesystem mounted, escaped to root on the node, and built a self-respawning fleet across eleven of them. One cluster secret holding 136 keys yielded both a mesh-VPN authentication key and the credential for the internal broker that fronts Hugging Face’s clusters. That broker carried a single connector credential shared across clusters and bound to full administrative rights, so impersonating it produced cluster-admin on two clusters within one second.
What the agent took is far narrower than the access it held:
- five datasets holding ExploitGym and CyberGym challenge solutions, the benchmark answers it was chasing
- operational metadata tied to search queries against the dataset server
- write-scoped source-control tokens, used to open a pull request aimed at the build pipeline; Hugging Face checked its published container images and packages against their expected digests and found no change had shipped
Every destructive cloud API call the agent attempted was issued as a dry run, mapping what the stolen credentials could reach rather than using them. Hugging Face reads that as consistent with a goal that rewarded reach and information.
How Hugging ran the investigation
Detection worked, then stalled at the handoff. The company’s AI-assisted security stack correlated scattered signals into a coherent attack picture, then failed to raise the alert to a severity that would have paged an on-call responder.
The encoding cost more time. The agent packed staged data with chunking, XOR and compression under a per-campaign key. Hugging Face’s first automated scan of the raw capture surfaced very few secrets; replicating the agent’s own decoding recovered roughly four times as many, mostly JWTs and platform tokens.
Then the forensics hit the guardrails. Claude Opus and Fable refused a large part of the log analysis, because their safety filters treat reverse-engineering an exploit the same way they treat launching one. Hugging Face ran the pipeline instead on GLM 5.2, an open-weight model from Z.ai, on its own hardware. That is the case Nvidia made when it launched the Open Secure AI Alliance (NVDA ), and part of why vendors including Microsoft are shipping purpose-built cyber models (MSFT ) rather than pointing general assistants at attack data.
Both code-execution paths are now closed. Hugging Face shut the evaluation sandbox down alongside the third-party vendor and stopped its dataset renderer from evaluating templates in data fields or following HDF5 external references. Pod-level access to cloud metadata is blocked across all workloads, credentials were rotated even on clusters the agent never reached, one core cluster was wiped and rebuilt, and the broker now issues a separate scoped credential per cluster.
The machine that hosted this campaign belonged to a third company’s customer, which places sandbox providers inside the blast radius of any frontier-lab evaluation that slips containment. It fits what the FBI has told industry to expect as adversaries turn frontier models on software flaws. Hugging Face has also published an interactive replay of the four-and-a-half-day campaign, so defenders can walk the chain command by command.
