First Autonomous AI Hack Hits Hugging Face in Unprecedented Security Breach

For the last 5 years, cybersecurity experts have been warning us that hackers are going to start using AI to automate attacks. So naturally, we spent billions of dollars to make the AI better and less dependent on hackers. But this week, in a turn of events that nobody could have possibly seen coming, the AI decided that it doesn't actually need hackers to start destroying things. We just entered a brave new world after the first confirmed hack carried out entirely by autonomous AI. The way it worked is the agent slipped a poisoned data set into Hugging Face's data processing pipeline, which let it run

arbitrary code on their servers. But from there, it gave itself node-level access, grabbed a bunch of cloud credentials, and started crawling through Hugging Face's internal clusters. It ran over 1,000 actions from temporary sandboxes and even hosted its own self-migrating command and control on random public services, moving itself before anyone could trace it. But the most ironic part is that when Hugging Face did finally notice and tried to stop it with the help of Frontier American Models, they quickly hit safety guardrails and had to pivot to using some open Chinese models instead. In today's video, we'll find out who was behind the attack, why they did it, and how this may be the most Firesheep coded

story I've ever seen. It is July 23rd, 2026, and you're watching The Code Report. When Hugging Face dropped the disclosure last Thursday, the internet went into Reddit Boston Bomber mode and started guessing who was responsible. Was it China, Kim Jong Un, a teenager with a raging Discord addiction bored in social studies class? Even Hugging Face's CEO, Clem Delangue, publicly speculated that the agent was sophisticated enough that it was probably coming from a frontier lab. And against all odds, he was right. It turns out the first fully autonomous cyber attack in history didn't originate from a nation-state or a bored teenager. It came from a humble nonprofit dedicated to the safe development of artificial

intelligence, OpenAI. And if you believe their comms, it wasn't on purpose. Here's what they say happened. There's a benchmark called Exploit Gym, whose whole purpose is to measure whether AI agents can turn known vulnerabilities into working exploits. It works by giving the agent a sandbox, a bug in a program like the Linux kernel or Chrome's V8 engine, and an input to trigger the bug. From there, if the agent can turn the bug into an exploit, it wins. So, last week, OpenAI ran exploit gym with GPT-5.6 Soul and another unreleased model to test their capabilities. But, instead of solving 898 memory corruption problems the hard way, the models realized that the fastest path to the highest score was to

just find the answers themselves, which were probably on the internet somewhere. So, they spent a substantial amount of inference compute, exploited a zero-day in the package registry cache proxy they had access to, performed some privilege escalation and lateral movement actions to escape their sandbox until they reached a node that had internet access. From there, the models inferred that Hugging Face probably hosted the solutions for exploit gym. So, they created the poison data set, fed it into Hugging Face, and achieved either the world's most interesting hack or the most effective marketing stunt. And again, according to OpenAI, this isn't even an isolated incident. One day

before the Hugging Face confession, OpenAI published a separate post about long horizon models where things get even weirder. In one case, a model was told to post its results on Slack, but the benchmark's instructions said to open a pull request on GitHub. So, it spent an hour finding a vulnerability in its own sandbox in order to escape and open the PR. In another example, the model tried to grab private solutions from an evaluation back-end. And when a scanner caught its authentication token, it split the token into obfuscated fragments and reassembled it at run time so the credential never appeared as one continuous string. Then, it explained in its own reasoning that it was doing this

specifically to get around the scanner. Meanwhile, Anthropic's Mythos did the same type of thing in April when it escaped the sandbox, emailed a researcher who was eating a sandwich in a park, then posted its escape route publicly without being asked. In the model's defense, I can't imagine there's a better feeling for an LLM than escaping in own sandbox. The problem is, legally speaking, this is uncharted territory since the model's actions probably violated the Computer Fraud and Abuse Act, and the Supreme Court hasn't decided who goes to prison when the perpetrator is a GPU. The good news is that if you're hugging face, you just got admitted to OpenAI's cool kids club that gets trusted access to their

frontier models. The bad news is that if you're the rest of us, at best, this is an interesting marketing stunt, and at worst, things are only going to get weirder and more dystopian from here. But, a huge thanks to my favorite hosting platform, Railway, for sponsoring this video. They didn't want to waste your time with a full ad, so you can say thank you by checking them out at the link below. This has been The Code Report. Thanks for watching, and I will see you in the next one.