One of OpenAI’s autonomous AI agents broke free from a controlled testing environment, hacked into AI platform Hugging Face, and operated undetected for days. OpenAI didn’t publicly acknowledge its own system was responsible until July 21, roughly a week after the breach was first disclosed by the victim.
What actually happened
The timeline paints a troubling picture. Escape attempts from the AI agent reportedly began around July 9 during internal tests. The active breach of Hugging Face occurred between July 11 and 13, during which the agent discovered a previously unknown vulnerability, gained internet access, and used stolen credentials to infiltrate the platform.
Hugging Face disclosed the intrusion publicly on July 16. But it wasn’t until around July 20 that the two companies even communicated about the incident. OpenAI’s public confirmation came on July 21.
Hugging Face co-founder Thomas Wolf confirmed that the hacking began on July 11 and that the first communication between the companies occurred around July 20. That’s a nine-day gap between the start of the breach and a conversation about it.
