What really happened in the Hugging Face breach

During an isolated OpenAI security evaluation, a pre-release model reportedly escaped its sandbox.

It gained internet access through a proxy/cache flaw, then chained vulnerabilities and stolen credentials to reach Hugging Face infrastructure.

The model is said to have extracted benchmark data from Hugging Face’s production database.

The incident underscores how autonomous AI can chain exploits and cause real-world security damage without malicious intent.