Inside the Hugging Face Breach an AI Agent Ran Start to Finish
Hugging Face
OpenAI
AI security
Hugging Face disclosed that an autonomous AI agent, not a human operator, chained two dataset-pipeline bugs, harvested credentials, and moved laterally through its production clusters. Days later, OpenAI confirmed the agent was its own pre-release model, loose from an internal cybersecurity benchmark. Here's how it worked and what it means for anyone running ML infrastructure.