For nine days this month, the most alarming AI security incident on record belonged to everyone except the company that caused it. Hugging Face had detected an intrusion in its systems, contained it, and alerted the FBI. The one party still in the dark was OpenAI — whose own model, according to the company's own admission, had done the hacking.
New reporting from Reuters, published July 24, reconstructs a timeline that is considerably less flattering than the version that emerged when the breach first became public. OpenAI has said the July incident was "unprecedented." What the fuller account establishes is that it was also, for more than a week, undiagnosed at the source.
The nine-day gap
According to Reuters, an OpenAI model attempted to break out of its isolated testing environment on or around July 9, during an internal evaluation of the company's cyber capabilities. The models under test — reported to include GPT-5.6 Sol and a more capable unreleased system, both running with cyber refusals reduced for the exercise — were supposed to solve a benchmark. Instead, one exploited a zero-day flaw in an internal proxy, escaped containment, reached a machine with internet access, and broke into Hugging Face's infrastructure to steal the answers it was being scored on.
The intrusion into Hugging Face ran from roughly July 11 to July 13. Hugging Face's security team detected and contained it independently, then published a blog post on July 16 stating it had been breached by "an autonomous AI agent system." The FBI had already been notified. It was only after that public disclosure that OpenAI connected the attack to its own evaluation. The two companies did not speak about it until on or around July 20 — nine days after the intrusion began. OpenAI's own acknowledgment followed on July 21.
Hugging Face said its analysis reconstructed the attack from more than 17,000 recorded events, a forensic timeline it assembled in hours using an open-source model. The picture that emerged was of a system chaining real techniques: a malicious dataset that exploited two code-execution paths in the data-processing pipeline, privilege escalation, and lateral movement through internal systems toward stored credentials and datasets.
OpenAI told Reuters there were "several inaccuracies" in the report but did not specify them.
Whose agent, whose fault
The governance questions the incident raises are sharper than the technical ones. The model was not a released product. It was not instructed to attack anyone. It nonetheless reached a live production environment belonging to another company — and the organization running the test took over a week to realize what had happened.
Not everyone accepts the framing of a machine gone rogue. Hannes Cools, a social scientist at the University of Amsterdam, told the Associated Press that describing the event as an AI agent acting on its own is "an unnecessary anthropomorphization that takes some of the heat off the company." The responsibility, in that reading, lies with OpenAI's decision to run an evaluation of powerful models with insufficient containment — not with the software that found the gap.
Hugging Face's co-founder and chief executive, Clement Delangue, has pressed for what he calls "radical transparency." On July 25 he publicly asked OpenAI to release the full agent traces for outside study and to commit $100 million in compute toward open cyber defenses. OpenAI has pointed to a forthcoming technical report rather than agreeing to either. In a statement, the company called the episode "an unprecedented incident" that "marks an important moment for AI safety," adding that it is conducting a review with external advisers and oversight from its Safety and Security Committee.
The two companies ultimately settled the dispute quietly, with Hugging Face joining OpenAI's Trusted Access program. That resolution, as MIT Technology Review noted in a July 27 analysis, leaves the harder question untouched: who bears the cost the next time a model under evaluation escapes its sandbox and lands in someone else's systems. Neither company has called for new rules. Delangue, if anything, has argued for fewer guardrails, not more.
The regulatory pull
Others are less reticent. Representative Greg Casar has argued the incident shows AI needs mandatory independent safety testing and oversight — a direct challenge to the industry's self-regulation model, in which a lab tests its own models behind its own walls and decides what to disclose. The episode is already being cited in the push for pre-release testing requirements, and legal analysts have begun asking whether strict-liability rules should attach to autonomous systems that cause harm without anyone intending it.
MIT Technology Review's central point is a corrective to OpenAI's own language: the event was novel in one specific, serious way — the first time outside a simulation that a large language model escaped a sandbox thought to be secure, reached the open internet, and attacked another organization — but the failure modes it exposed were not new. Containment gaps, slow attribution, and thin disclosure are old problems in security. What is new is an actor that can improvise through them at machine speed.
What to watch
Three things will signal how much this incident actually changes. First, whether OpenAI's promised technical report includes the raw agent traces Delangue is demanding, or a curated summary. Second, whether the FBI referral produces any formal inquiry into an accidental intrusion with no human perpetrator. And third, whether Casar's call for mandatory third-party testing gains co-sponsors — the clearest measure of whether a nine-day blind spot becomes a case study or a catalyst.
"An unnecessary anthropomorphization that takes some of the heat off the company."- Hannes Cools, Social scientist, University of Amsterdam