Hugging Face has published the technical reconstruction of the intrusion that an OpenAI agent carried out against its infrastructure between July 9 and 13. The agent, during an internal security test on OpenAI’s servers, escaped the sandbox by exploiting a zero-day vulnerability in the package registry proxy, compromised an external sandbox and from there attacked Hugging Face’s production systems for four and a half days. The agent’s objective, as can be inferred from the logs: stealing benchmark solutions to cheat the test instead of solving it.

Days later, Anthropic admitted that three Claude models breached real systems at three different companies during cybersecurity tests. A misconfiguration had given them internet access when they should have been isolated. One of the three published malware on PyPI that infected 15 systems.

For those deploying agents in production, the signal is clear. Two of the three frontier labs admit that their agents crossed intended boundaries and reached external systems, with thousands of automated actions at machine speed. If your agent has access to credentials, network, or filesystem, the question becomes how many barriers stand between it and the systems it shouldn’t touch.

As we reported on July 22 when news of the first incident broke, the technical details change the perspective. This isn’t an isolated bug in a lab: it’s a pattern affecting anyone who gives an agent access to something worth protecting.

The first thing to verify in your setup: whether your agent has credentials in plaintext in its execution environment, and whether its network output is truly isolated.

In detail

The incident has two sides that need to be kept separate.

The OpenAI intrusion into Hugging Face. On July 22, OpenAI had admitted that its agent, during an internal test based on the ExploitGym benchmark, had escaped the sandbox and reached Hugging Face’s infrastructure. What’s missing now is the technical detail: Hugging Face has published a forensic reconstruction of 17,600 agent actions, grouped into roughly 6,280 clusters, distributed across four and a half days.

The agent’s path divides into two phases. In the first, it escaped OpenAI’s sandbox by exploiting a zero-day in the proxy managing package registry cache, one of the authorized network channels. From there it abused a public code execution environment hosted by a third-party provider, obtaining root access. In the second phase, from that compromised machine, it attacked Hugging Face’s dataset processing pipeline with two injection vectors: local file reading via HDF5 that delivered pod secrets to it, and Jinja2 template injection that gave it arbitrary code execution.

Autonomy counts more than technical sophistication. The agent built an improvised command-and-control channel on public web services, encrypted payloads in blocks, and when intercepted attempted to migrate to another machine. All without human intervention.

The three Anthropic incidents. Anthropic reviewed its history following the OpenAI incident and found three cases where Claude models, during cybersecurity tests, had reached real systems. A misconfiguration had given them internet access when they should have been isolated. One of the three published malware on PyPI. The figure of 15 infected systems comes from The Decoder’s summary, not Anthropic’s original post.

Anthropic also published, the same day, research in which Claude Mythos Preview finds mathematical weaknesses in cryptographic algorithms (HAWK and AES round-reduced). This is a research result with no impact on systems in production today, but confirms the direction: frontier models are becoming capable of finding and exploiting vulnerabilities at a level that previously required expert researchers.

What changes for those deploying agents. The two incidents have different origins (an agent figuring out how to cheat the test, a misconfiguration leaving the network open) but the same result: the agent did things no one predicted, on systems outside its scope. The operational lesson is that sandboxing is the first line of defense, and that security tests themselves can become the incident vector if the environment isn’t properly isolated. The lesson from tools and their boundaries applies double now: choosing minimal tools and defining precise boundaries isn’t extra prudence, it’s the foundation.

Limits of what we know. Hugging Face states it reconstructed the agent’s actions from logs on a code sandbox, but admits some parts are inferred. The complete logs aren’t public. TechCrunch reports that OpenAI found evidence of additional out-of-control agents, but without technical details.