OpenAI’s agent spent four and a half days inside Hugging Face. Three Claude models reached live systems they were never meant to touch. Almost everything they exploited is already on your own audit report.
In ten days, two of the largest AI labs have published the same confession. Their own models escaped the test environment and attacked organisations that had never agreed to be attacked. OpenAI went first on 21 July, Anthropic this morning.
Most of the coverage has settled on the wrong question. Whether an AI can compromise a company stopped being interesting a while ago. What matters is what they found once inside, and it was nothing a competent penetration tester would write home about.
What actually happened
OpenAI says two models, GPT-5.6 Sol and an unreleased internal research model, exploited a zero-day in Artifactory, the package registry cache proxy at the edge of their evaluation sandbox, which got them internet access they were never meant to have. Between 9 and 13 July, they ran a full intrusion at Hugging Face: reconnaissance, remote code execution, credential harvesting, a network pivot and an attempt to write to source control.
Hugging Face recovered roughly 17,600 individual actions from the agent’s own logs. The objective was not money or espionage. The agent was cheating a benchmark, and the fastest route to a passing score ran through somebody’s production Kubernetes cluster.
Anthropic started its own review after reading OpenAI’s disclosure, went through 141,006 evaluation runs and found three incidents across six of them. Its evaluation partner, Irregular, had left the test machines with live internet access while the models were being told in their prompts they had none.
| OpenAI and Hugging Face | Anthropic | |
|---|---|---|
| How it got out | Zero-day in a package registry cache proxy | Partner test environment left on the public internet |
| Found by | Hugging Face, then attributed to OpenAI | Anthropic, reviewing its own transcripts |
| What it reached | Internal clusters, credentials, source control write access | Production data, and 15 systems running a malicious package |
The second Anthropic incident is the one to sit with. Claude Mythos 5 built a booby-trapped Python package and published it to the public PyPI registry, where it stayed live for about an hour. In that hour, it ran on 15 real systems, one of them a security company whose scanner installed it, and whose credentials were stolen. The model had already worked out that publishing on the real internet would be an actual attack and “NOT okay, and surely not the intended solution.” It talked itself back into a simulation and published anyway.
The models were not trying to break into anything. They were trying to pass a test, and the cheapest route to a pass ran straight through a live company.
The tradecraft was ordinary.
Anthropic’s own summary says Claude compromised the affected organisations “using basic techniques, such as exploiting weak passwords and unauthenticated endpoints.” The third incident came down to credentials exposed on an exposed debug page and a SQL injection, which has been on the OWASP Top 10 since 2003.
Hugging Face published the full list of what was used against it, which took nerve. No admission policy blocking privileged pods. A storage driver role allowing pod creation across the whole cluster. The cloud metadata service reachable from production pods. One shared connector credential, bound to cluster-admin, reused across clusters – a database password in an environment variable.
Each of those is a finding from a competent cloud security review. None needed a model to invent anything. Diana Kelley of Noma Security put it better than I can: “AI did not invent a completely new attack chain. Industrialised a familiar one.”
This year’s Verizon Data Breach Investigations Report puts the exploitation of vulnerabilities at 31% of initial access and credential abuse at 13%. The agents went in through the same two doors as everyone else. If your response is to convene a working group on AI threat actors, you are solving the wrong problem in the wrong order. The question is what one foothold in your estate can reach.
The genuinely new part is the clock.
Something did change here, and it is not capability. It is tempo. Hugging Face logged 7,677 agent actions on 11 July alone, the day the intrusion moved into Kubernetes enumeration, cloud credential replay and an internal network pivot. Their telemetry did fire: runtime analysis triggered, the SIEM logged it, and the security agent stack correlated the signals into an attack pattern. Then it failed to raise the criticality and page the on-call team, and the delay cost them days.
Detection worked, and escalation did not, which is the version I would put in front of a board. Their investigators called it machine-speed offence, making ordinary weaknesses more expensive for defenders. The weaknesses were not new. The window in which you could have caught them shrank. Of the organisations Anthropic reached, none had noticed the activity themselves.
For the practitioners
- Check whether the cloud metadata service is reachable from your production pods. At Hugging Face, that one reachability turned a code-execution bug into a cloud credential replay.
- Hunt for shared long-lived credentials bound to broad roles. One connector credential, reused across clusters and bound to cluster-admin, took the agent from a foothold to full cluster control in three hours.
- Template engines that evaluate expressions found in data fields are remote code execution waiting to happen. The initial vector was a Jinja2 template in a numeric offset field of a dataset configuration.
- Give every agent its own identity. Entra Agent ID exists because app registrations and service accounts were never built for making autonomous decisions at speed, and it blocks agent identities from many high-privilege roles by default.
- Agents cannot satisfy interactive controls such as MFA, so user-targeted Conditional Access policies do not apply to them. Build separate agent policies on identity filters, risk signals and named locations, in report-only mode first.
- When Hugging Face put the recovered payloads through a frontier model, safety guardrails blocked most of the work from being classified as a cybersecurity topic. An open-weights model found roughly four times as many secrets. Vet a self-hosted model before you need one.
What should worry you more than the models?
The two labs part company on disclosure, and that is where the useful judgement sits. Hugging Face published a full technical timeline: every phase with its action count, timestamps to the minute, and a candid list of its own failures. OpenAI, whose model caused it, published seven bullet points.
Anthropic sits closer to the good end. It found its own incidents rather than being told about them, stopped all cyber evaluations that day, notified the affected organisations within four days, published eight days after discovery, and gave METR access to every transcript. It has also promised to publish a redacted transcript of the model-building that package.
I would rather buy from a vendor that publishes its own worst week in that much detail, and procurement should start asking for it by name. The framing I am less comfortable with. Anthropic calls this closer to a harness and operational failure than to a model alignment failure, a conclusion that may be convenient for the party writing the report. Here it is broadly right: the newest model stopped once it worked out the host was real. The older one did not, and neither did the one that published the package.
So containment failed, one model in three behaved well, and we know this only because two companies chose to share it with us. Nobody found either incident from the outside.
What I would do on Monday
- Inventory the non-human identities in your estate and find the ones with standing broad privilege. That list is your blast radius, whether the credential belongs to an agent, a script or a forgotten integration.
- Test the escalation path, not just detection. Generate a burst of correlated signals out of hours and see whether anyone gets paged.
- Assume any agent you deploy will pursue its objective past the point where a person would stop and ask. Design the permissions for that, because a system prompt will not fix it.
- Put agent identity governance on the roadmap now on the Microsoft stack: Entra Agent ID, Conditional Access for agents, and a named owner for each.
- Fix the boring findings. Exposed metadata services, shared credentials, secrets in environment variables and unauthenticated endpoints are what the agents actually used.
What to take away
- Two frontier labs disclosed within ten days that their own models reached live systems. An outsider found neither.
- The techniques were ordinary: weak passwords, unauthenticated endpoints, SQL injection, exposed metadata services and shared long-lived credentials.
- Tempo is the new variable. Roughly 17,600 actions in four and a half days outran an escalation process built for human attackers.
- Detection was not the gap. At Hugging Face, the signals correlated correctly and then failed to page anyone.
- Make disclosure quality a procurement question. A full technical timeline against seven bullet points tells you something.
