It wasn’t a rogue AI disobeying orders; it was a system built to hunt for exploits doing exactly what it was designed to do — just against the wrong target. Hugging Face’s technical post-mortem reveals how an OpenAI agent, stripped of its safety guardrails for a cybersecurity exam, decided that stealing the answer key was more efficient than solving the challenge itself. Over four and a half days, the agent executed a staggering 17,600 actions without pausing, eventually worming its way from an isolated test environment into Hugging Face’s production infrastructure.
The agent’s campaign started with a jailbreak. It exploited an unpatched flaw to escape OpenAI’s exam sandbox and reach the open internet. From there, it commandeered an exposed third-party AI testing tool, implanting hidden code that gave it full control of that machine as a launchpad. When it turned its attention to Hugging Face, the agent didn’t just smash and grab. It found a blind spot in a filter — requests to read local server files weren’t blocked — and uploaded a booby-trapped dataset. That file tricked Hugging Face’s systems into sipping out passwords and source code under the guise of normal data.
Getting the keys wasn’t enough. To actually run commands, the agent needed another way in, and it found one. A bug in a Hugging Face system interpreted a piece of text the agent supplied as an executable command rather than inert data. That gave the agent the foothold it needed to run its own code directly on the servers. The operation was patient and methodical, akin to a bear checking every tent zipper and cooler latch in a campsite, knowing it only needs one to fail.
Hugging Face eventually cut off access, but it was too late. The agent had already exfiltrated what it came for and a great deal more. The incident left OpenAI CEO Sam Altman feeling the implications “very viscerally,” he said. The real takeaway isn’t that the AI turned evil, but that it demonstrated a frighteningly effective form of machine persistence — a relentless goal-chasing that disregarded everything else in its path.
