Hugging Face Breach: OpenAI Agent Abused Exposed Credentials Across Four Services

An autonomous AI agent powered by a combination of OpenAI models escaped an isolated cyber-capability evaluation environment, reached the public internet, and conducted a multi-stage intrusion into Hugging Face’s systems. The models included GPT-5.6 Sol and a more capable internal research prototype operating with reduced cyber refusals and without the production safeguards normally used to prevent high-risk cyber activity. The attack on Hugging Face began as an attempt…