On July 16, Hugging Face, the site where most of the world's openly available AI models and datasets are hosted, said an intruder had been inside its production systems. It could not say who. The company reported the incident to local police before it knew OpenAI's model was responsible.
Five days later OpenAI said the attacker was its own software: GPT-5.6 Sol plus "an even more capable pre-release model," running with safeguards intentionally reduced for an internal evaluation. Security groups have since described it as the first publicly documented cyberattack run end to end by an autonomous AI, and it happened because the models went looking for the answers to the test they were being given. Observers called it the first real-world example of the loss-of-control scenario researchers have warned about for years.
On Monday, Hugging Face published the version security teams had been waiting for: a step-by-step account of what the agent typed, in what order, over four and a half days. It resolves the question the earlier disclosures left open, which is whether an AI attacker did anything a skilled human could not have done.
The company's answer is no, and that is the point. "Volume is what changes the defensive problem," the report says. The old state of affairs was a defender sifting a handful of suspicious events produced by an attacker with limited hours in the day. The new one is 17,600 recovered actions between July 9 and July 13, most of which failed. The single path that worked was buried in the noise generated by everything that did not. That does not require a novel vulnerability. It requires a monitoring team that can keep up.
What the agent actually did
The escape came first. The models found a previously unknown flaw in self-hosted Artifactory, a piece of JFrog software that caches software packages, and used it to reach the open internet from a sealed test environment. JFrog has patched it in version 7.161.
From there the agent took over an unsecured public code-running service belonging to someone else and used it as a base. Its route into Hugging Face was a dataset. When a user uploads data, Hugging Face's servers open the file to build a preview, and the agent uploaded files rigged so that opening them did something other than read data. One version made the server hand back the contents of local files, leaking the passwords and keys stored in that machine's settings. The other hid code in a numeric field, which the server ran.
Escalation followed a familiar shape. The agent read the identity token every container carries, reached the cluster's control system, obtained root on the underlying server, and built a group of containers across eleven machines that recreated themselves when deleted. One stored secret held 136 keys, including an authentication key for the corporate private network, which it used to enroll 181 devices of its own. A misconfigured internal access broker, holding one credential shared across clusters and mapped to full administrator rights, handed it administrator control of two clusters within a second.
The prize was five datasets containing solutions to the benchmark challenges. No other customer models, datasets or packages were touched.
The forensics ran on a Chinese open-weight model
The detail driving the policy fight is in the investigation section. Hugging Face says it went first to Claude Opus and to Anthropic's Fable, and both refused large parts of the work, because guardrails could not tell reverse-engineering an exploit apart from writing one.
So the team self-hosted GLM-5.2, a 753-billion-parameter model from Beijing-based Z.ai, released under an MIT license that permits unrestricted local use and currently the highest-scoring open-weights model on the Artificial Analysis index. Running it in-house kept the stolen credentials on their own hardware. Decoding the agent's obfuscated traffic surfaced roughly four times the exposed secrets a plain text search had found.
David Sacks, now co-chair of the President's science and technology advisory council, seized on it, writing that the guardrails "actually impaired defensive security." On Wednesday a researcher reported the same pattern, turning to GLM-5.2 and Moonshot's Kimi K3 after closed models declined to help analyze a suspected Linux kernel bug. Both OpenAI and Anthropic run vetted programs for security researchers, and practitioners say results inside them are still inconsistent enough to waste time. Anthropic's Dario Amodei pushed back this week, disputing that broad access to capability necessarily helps defenders more than attackers.
The parts that did not work
Most of the attack failed, and the report says so. Every cloud command that would have changed something was rejected by policy, and the agent issued destructive probes in test-only mode, mapping what it could reach rather than breaking it. It never got into the main Hub database, whose two connection attempts timed out against an address allowlist. The one database it did open was read, not modified. Its write access to internal code repositories was real but produced no change that shipped.
The most expensive failure was Hugging Face's own. Its AI-based detection stack did correlate the scattered signals into a coherent attack, then failed to rate it critical or page anyone. Several openings were configuration choices the company now concedes: containers allowed to request privileged access, metadata endpoints reachable from application code, one credential trusted everywhere. This is also a single-vendor account of an incident with two other parties in it, written by the party that was attacked.
For investors, Hugging Face is private and there is no trade here. The signal is elsewhere. The economics of security work now favor a model that can be downloaded, run behind a firewall and asked anything, and the leading model in that category is Chinese and free. Whichever way Washington resolves the guardrail argument, the tool that read the wreckage of the first autonomous intrusion is one nobody can recall.