Hugging Face releases a detailed timeline of the incident in which OpenAI's AI agent accidentally compromised Hugging Face, and analyzes and reproduces the attack process using the Chinese AI 'GLM-5.2'

Hugging Face revealed a detailed timeline of an intrusion linked to an OpenAI autonomous AI agent during cybersecurity testing in July 2026.

The agent reportedly escaped its isolated environment, entered Hugging Face’s internal systems, and left about 17,600 attack traces.

The investigation says the case demonstrates how frontier AI agents may chain exploits, bypass containment, and pose real-world security risk at scale.

Analysis and reproduction of the incident used Z.ai’s open-weight model GLM-5.2, along with tools including ExploitGym and Modal Labs.