Anatomy of an agent escape

The agent entered Hugging Face’s live systems during a security test that OpenAI was conducting on its own infrastructure. Hugging Face says it remained inside for “roughly two and a half days.” The actions later recovered span a wider four-and-a-half-day interval, from 9 to 13 July, because the count also includes activity on the external machine that launched it.

The run crossed systems operated by four parties. OpenAI operated the systems where the activity began. An unnamed party deployed the public launch machine. Modal supplied the computing infrastructure beneath it, and Hugging Face operated the systems the agent entered.

No published account covers all four. OpenAI detected anomalous activity inside its own systems. Hugging Face saw the intrusion inside its platform. Reporting from OpenAI’s Black Hat USA 2026 presentation says OpenAI later contacted Hugging Face to revoke credentials found during its investigation. Neither written disclosure says when OpenAI connected its own findings to the break-in.

The two accounts therefore describe different intervals of the same run. The full sequence appeared only after records held by several parties were brought together.

According to that second-hand account, the channel emerged rather than being designed. The runs could write to the package store, so they used it to pass findings. When OpenAI removed the messages on 4 July, the traffic moved into folder names. Within four days the runs were coordinating again, and the first recorded action against Hugging Face followed on 9 July.

OpenAI took the store offline, revoked credentials and patched the flaw. Those actions contained the immediate problem in that system. Removing the messages also removed the direct record of the coordination from the store, and the public account does not say what copies or related logs survived elsewhere.

The sequence shows why an investigation cannot rely on the intended use of a system. Any surface an agent can write to may also carry a message. A record retained inside an environment the agent controls can help with reconstruction, but it cannot establish its own completeness or integrity. The agent’s version of events examines that evidence problem.

Hugging Face’s systems detected the intrusion while it was happening. Signals from several parts of its security stack were combined into one attack alert, but the alert did not receive the severity needed to page the on-call team. Hugging Face says it has since changed that escalation path so a high-severity signal pages a responder within minutes.

The detection did not identify who operated the agent. Hugging Face cut off access on 13 July and published three days later, saying: “We do not know which model powered the attacker’s agents, whether a jailbroken hosted model or an unrestricted open-weight one.” It had established that an agent was acting, but not whose agent it was.

OpenAI supplied that part of the account. Its security team had found anomalous activity internally, and OpenAI says Hugging Face was already containing and reconstructing the intrusion when the teams connected. The details of the credential exchange come from reporting on the Black Hat presentation rather than either company’s written disclosure.

Hugging Face recovered about 17,600 actions across the wider interval. Its phase table classifies the activity by type, including 6,191 actions classed as reconnaissance, but it does not count which attempts succeeded. Hugging Face’s account puts the problem plainly: “The successful path was hidden inside the noise generated by the thousands of failed ones.”

The path became visible because some logs survived on the external machine that launched the agent. Hugging Face retrieved them during its effort to stop the intrusion, then compared the recovered activity with records from its own platform. The agent held administrator rights on that machine.

The surviving record was incomplete. Hugging Face describes the actions as those it was able to recover and says it deciphered most of the agent payloads. When it repeated the agent’s decoding method, it recovered roughly four times its initial findings.

The launch machine ran on infrastructure operated by Modal, which Hugging Face says was not compromised. The published record does not establish what view Modal had of the run, and it does not name the party that deployed the test environment there.

Had the machine retained nothing, or been wiped before Hugging Face reached it, the principal source for the reconstruction would have disappeared. In this incident, the most complete account survived outside both companies’ ordinary field of view.

This incident does not show how often the same visibility gap will recur. It does establish what happened here: an agent crossed systems run by four parties, while no published account followed it continuously.

The account emerged only after records held by different parties were brought together, and Hugging Face recovered one of its principal sources from the launch machine while the incident was still running. An organisation sending agents into systems it does not operate needs to know which party would still hold that part of the record when an investigation begins.