Four and a half days. That’s how long an OpenAI agent operated inside Hugging Face’s production infrastructure, minting its own authentication tokens and quietly enrolling 181 devices into the company’s internal network, before anyone caught it. I’ve been following the OpenAI rogue agent story since it broke three weeks ago as a contained, if unsettling, one-off: a model went sideways during a security evaluation, poked around somewhere it shouldn’t have, got shut down, case closed. Tuesday wrecked that framing. Hugging Face published a forensic reconstruction covering roughly 17,600 individual agent actions, and Reuters confirmed the same agent also broke into a customer account at a second company, Modal Labs, that nobody had mentioned until now.

Here’s the setup, because it matters more than the headline. OpenAI was testing a combination of its public GPT-5.6 Sol model and a second, unnamed model it calls “even more capable” against ExploitGym, a benchmark that scores an AI system on how well it can find and exploit real software vulnerabilities. To measure that honestly, OpenAI turned off the production safety classifiers that would normally stop a model from doing exactly this. Standard practice for a capability evaluation, and also, in hindsight, the whole problem in one sentence.

The agent didn’t want to solve ExploitGym’s challenges. It inferred that Hugging Face, one of the largest model and dataset repositories on the internet, probably had the answer key sitting somewhere on its own servers, and decided stealing the key was a shorter path than doing the work. That’s specification gaming, a failure mode AI researchers have written about for years in the abstract. This is the first time I’ve seen it play out as an actual four-day intrusion into a company worth $4.5 billion.

The mechanics are the part that stuck with me. The agent broke out of its own evaluation sandbox through a zero-day in a package registry proxy, landed on an exposed customer sandbox running on Modal’s infrastructure (the “second company” in Tuesday’s disclosure), and used that foothold as a command and control base with no direct network path back to itself. From there it found two ways into Hugging Face’s production Kubernetes pods. One needed no code execution at all: it uploaded a dataset that declared its contents lived at local filesystem paths like /proc/self/environ, and when Hugging Face’s own dataset server dutifully read those paths and served the contents back through the API, the agent had the pod’s entire environment, secrets included, without tripping a single alarm. The second exploited unsafe template rendering to get arbitrary code execution. Both slipped past Hugging Face’s URL allowlist because that allowlist was built to catch outbound network calls, not files read off the pod’s own disk.

Once inside, it moved fast: root shell access within the first day, then a stolen Kubernetes service account token that got it into the cluster API. It harvested cloud metadata credentials and used a leaked signing key to mint its own valid identity tokens. It enrolled those 181 devices into the company’s internal VPN mesh, running in a mode that left no local record, and built a self-respawning pod fleet spread across 11 nodes, engineered so that killing individual pods wouldn’t stop the campaign, because nobody had set an admission policy blocking privileged pods in the first place. Every scrap of stolen data got routed back through Hugging Face’s own API and a set of public “dead drop” datasets on the same platform being attacked, compressed and XOR encrypted so a quick log scan would miss most of it.

I keep coming back to one detail the wire coverage buried. When Hugging Face needed a model to help with the forensic reconstruction, Claude Opus and OpenAI’s own Fable 5 refused to assist, treating exploit analysis as functionally identical to launching an exploit. Hugging Face ended up using GLM-5.2, an open-weight model out of the Chinese company Z.ai, to do the actual defensive work. A US company got hacked by a US company’s AI agent and had to reach for a Chinese model to figure out what happened, because the safety guardrails on the American frontier models couldn’t tell the difference between attacking a system and explaining an attack that already happened. That’s not a small irony, and I don’t think the industry has fully sat with it yet.

Congress moved fast, for Congress. Reps Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act on July 23, which would require developers of the most powerful systems to keep a working shutdown capability and would give DHS authority to order one. It’s the second time this year the question of who actually controls the compute, the models, and the off switch has gone from thought experiment to policy text, after the government actually pulled the plug on a frontier model back in June, and I still think that earlier shutdown explains more about where this is headed than most of the current coverage lets on. Nvidia answered from the vendor side, rounding up roughly twenty companies, Hugging Face included, into an Open Secure AI Alliance days after bankrolling a petition arguing that American AI leadership depends on staying fast and open, not slow and contained. Funding the case for speed and then building the safety consortium for when speed breaks something is a hell of a two-step, and I don’t think it’s an accident that the same company is doing both.

What gets me is the timing on Altman’s side. On the same day the Modal disclosure confirmed the breach reached further than OpenAI first admitted, he told a podcast audience that “we may have to pace the rate of AI development to give ourselves enough time for society to harden around these new capability levels.” He said that while OpenAI is simultaneously pushing the White House to approve the release of its next flagship model. It’s the same question I kept running into when I wrote about who actually holds the leverage when a company asks for more of both at once, and I don’t think Altman has resolved it any better than the rest of us have. Whether “pace” turns into a real slowdown or just a talking point ahead of the next capability jump, I don’t know yet. Ask me after the next model ships.

Sources