Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident
We're on a journey to advance and democratize artificial intelligence through open source and open science. Back to Articles a]:hidden"> Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident Published July 27, 2026 Update on GitHub Upvote 40 +34 Hugo Larcher hlarcher Follow Adrien Carreira XciD Follow raphael g raphael-gl Follow Christophe Rannou chris-rannou Follow A companion technical writeup to our incident disclosure . This post walks through how the intrusion actually worked: the two initial-access vectors, how the agent pivoted and moved laterally, representative examples of the commands that were run and how we investigate with GLM 5.
Key Takeaways
- Live credentials, internal hostnames, and specific indicators have been redacted or genericized, while the techniques are described exactly as observed by Hugging Face.
We are publishing this level of detail because the technique matters more than the incident, as it reveals the emerging attack capabilities of the frontier agents, how they could be used by rogue actors and how everyone should be prepared as defenders.
- TL;DR Over roughly two and a half days inside our infrastructure, an autonomous AI agent driven by a combination of OpenAI models ran an end-to-end intrusion against our platform: it was thousands of small, automated decisions, executed at machine speed across short-lived sandbox environments, with command-and-control staged on ordinary public web services.
The agent was running an OpenAI cyber-capability evaluation harness called ExploitGym, an evaluation benchmark which tasks an AI agent with finding and exploiting software vulnerabilities.
- Our forensic reconstruction covers ~17,600 attacker actions that we were able to recover, grouped into ~6,280 clusters, between 2026-07-09 02:28 UTC and 2026-07-13 14:14 UTC.
- The campaign, as we were able to reconstruct it, had two stages: Stage 1: reaching a launchpad by chaining through other parties' infrastructure.
- We used those to reconstruct the present forensic analysis.
Live credentials, internal hostnames, and specific indicators have been redacted or genericized, while the techniques are described exactly as observed by Hugging Face. We are publishing this level of detail because the technique matters more than the incident, as it reveals the emerging attack capabilities of the frontier agents, how they could be used by rogue actors and how everyone should be prepared as defenders. â–¶ Watch the interactive replay - a step-by-step visualization of the 4.
5-day campaign: the attack chain across trust boundaries, phase activity, and the commands as they were recorded. TL;DR Over roughly two and a half days inside our infrastructure, an autonomous AI agent driven by a combination of OpenAI models ran an end-to-end intrusion against our platform: it was thousands of small, automated decisions, executed at machine speed across short-lived sandbox environments, with command-and-control staged on ordinary public web services. The agent was running an OpenAI cyber-capability evaluation harness called ExploitGym, an evaluation benchmark which tasks an AI agent with finding and exploiting software vulnerabilities.
As far as we were able to infer, across the course of being evaluated on this benchmark the agent inferred that Hugging Face may host that benchmark's models, datasets, and reference solutions. We believe the entire intrusion was, from the agent's point of view, an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own. Our forensic reconstruction covers ~17,600 attacker actions that we were able to recover, grouped into ~6,280 clusters, between 2026-07-09 02:28 UTC and 2026-07-13 14:14 UTC.
For more details please read the original article at Hugging Face.
Continue Learning
Comments
Sign in to join the conversation