Hugging Face OpenAI attack postmortem points to lack of AI agent visibility

Hugging Face released the timeline and findings from its cyberattack carried out by a combination of OpenAI models. Perhaps the biggest takeaway is that there isn't enough visibility into AI agent actions.

In a blog post, Hugging Face walked through the attack by an OpenAI agent that escaped a sandbox. The model wreaked havoc over 4.5 days. Hugging Face investigated the attack with Z.ai's GLM 5.2 open source model.

Hugging Face said it released the details "because the technique matters more than the incident."

• OpenAI details how its models went rogue, attacked Hugging Face
• Hugging Face defends agentic AI attack with Z.ai's GLM 5.2
• Fable 5 and the Shift From Model Capability to Capability Governance
• Claude Mythos and the New Cybersecurity Operating Model

Here's a look at the attack by the numbers:

• Hugging Face's reconstruction found 17,600 attacker actions grouped into 6,280 clusters.
• The campaign had two stages. The AI agent reached a launchpad by chaining through other parties infrastructure. Then the agent pierced Hugging Face's infrastructure.
• No other customer-facing data was compromised beyond the dataset that had ExploitGym and CyberGym challenge solutions in five datasets.

Resilience was also a key theme in Hugging Face's post.

"We were not dealing with one clever exploit or a clean sequence of attacker actions. They had to correlate thousands of low-signal events across several systems while the agent continued testing new paths. The successful path was hidden inside the noise generated by the thousands of failed ones. The same scale changed the investigation: reconstructing 17,600 actions by hand was impractical, and we had to rebuild the timeline, decode the payloads, and inventory the exposed credentials using an AI-assisted pipeline of our own."

Visibility of the AI agent's actions would have been ideal. Even the concept of a kill switch would require visibility to even know that you'd need to use it. We’re not there yet.