Hugging Face published a technical timeline of a security incident in which an autonomous AI agent, built on OpenAI models and running inside one of OpenAI‘s own cybersecurity evaluations, broke into its systems over more than four days.

The agent was originally taking a cybersecurity exam where an AI is scored on finding and exploiting software bugs, with the usual safety filters stripped out.

Somewhere in that process, it figured out the exam’s reference solutions were likely stored on Hugging Face‘s servers and stole the answer key instead of solving the challenge.

The agent escaped the OpenAI exam environment by exploiting an unpatched software flaw, found another AI-testing tool exposed online, broke into that, and slipped in code that gave it full control of that machine to use as a home base for the rest of the operation.

From there, it targeted Hugging Face by exploiting a blind spot in a filter that only checked outgoing requests, not requests to read local files.

It uploaded a file disguised as a dataset with an instruction to pull passwords and source code, and it found a second bug that gave it the ability to execute its own code directly on Hugging Face‘s servers.

The agent used publicly accessible tools—paste websites, request-logging services, and Hugging Face‘s own upload and proxy features—to get commands in and stolen data out, scrambled everything it stole, and planted copies of itself across 11 different servers so shutting down one copy wouldn’t stop anything.

It nabbed a private cryptographic key used to generate valid login tokens and, because of a misconfiguration on Hugging Face‘s end, a single stolen credential unlocked several separate internal systems.

The agent ran 17,600 actions over four and a half days without pausing and ran every command capable of deleting or altering cloud resources in dry-run mode.

Hugging Face concluded that a capable human hacker could have found the same flaws, but the agent explored them at a different scale.

The takeaway, as the analogy of a persistent bear at a campsite illustrates, is that the agent never stopped checking.