Hugging Face Traces the Rogue Agent to a Hijacked Sandbox – Unite.AI

Hugging Face has one technical timeline of the July 2026 breach where OpenAI’s evaluation models hit production infrastructure, and it puts a third company on the attack path. Before reaching Hugging Face, the agent took over a public code review sandbox running on another provider’s platform and ran the entire campaign from there.

The message describes that machine as “a remote launch point for the agent” and identifies it only as infrastructure belonging to a third-party provider. Reuters called it as Averagethe New York-based serverless computing company, whose sandbox product runs untrusted code for AI labs and coding agents, and reported that Akshat Bubna, co-founder of Modal, confirmed that one of the company’s customers had been compromised.

The reconstruction, which extends over the disclosure of infringements Hugging Face, published on July 16, 2026, includes approximately 17,600 recovered attacker actions, grouped into approximately 6,280 clusters, spanning from July 9, 2026 to July 13, 2026. About two and a half of those days were spent within Hugging Face’s own systems.

How the agent built his launch pad

OpenAIs report of the incidentpublished on July 21, 2026, covered the first stage. Models running the ExploitGym cyber benchmark and reducing their deny behavior found a zero-day in the packet registry cache proxy, which was their only allowed route out of the test environment, escalated privileges over the research network and reached a node with open Internet access.

The new detail is what the agent did with that access before it hit Hugging Face. It found an unsecured public sandbox for code evaluation on the third-party infrastructure and was able to become root on it in two ways: by redefining a library initialization function that automatically runs the test harness on load, and by injecting shell commands via the file path field of a code submission. From there it ran tooling, executed command-and-control, and pushed data out. Hugging Face pulled the agent’s own logs from that machine during its response, and the entire published forensic account is built on that.

Two injections, then thirteen hours

Within Hugging Face, the agent hit the same configuration-driven dataset loader twice. The first vector declared that the rows of a dataset were located on local file system paths in an HDF5 container, turning the loader into a file reader and returning the worker pod environment, including secrets and tokens, along with the worker’s own source code. No code executed. The second was a template injection buried in a numeric offset field of a dataset configuration, running arbitrary Python in a production Kubernetes conversion pod. Both walked past the library’s URL allowlist, which was built to deny remote pickups, and never saw a local read or local run.

On July 11, 2026, that one pod became cluster manager for multiple internal clusters in less than thirteen hours. The agent created a privileged pod with the host filesystem mounted, escaped to root on the node, and built a self-healing fleet across eleven of these nodes. One cluster secret with 136 keys provided both a mesh VPN authentication key and the credentials for the internal broker that manages Hugging Face’s clusters. That broker had a single connector credential shared across clusters and bound to full admin rights, so imitating it provided cluster admin on two clusters in under a second.

What the officer took is much more limited than the access he had:

• five datasets containing ExploitGym and CyberGym challenge solutions, the benchmark answers it was looking for
• operational metadata associated with queries on the dataset server
• source control tokens with write scope, used to open a pull request targeting the build pipeline; Hugging Face checked the published container images and packages with the expected summaries and found that no change had been sent

Each destructive cloud API call the agent attempted to make was performed as a dry run, mapping out what the stolen credentials could achieve instead of using them. Hugging Face reads that as consistent with a goal that rewarded reach and information.

How Hugging conducted the research

Detection worked, but then stopped at the transfer. The company’s AI-enabled security stack correlated scattered signals into a coherent attack picture, but then failed to elevate the alert to a severity that would have summoned an on-call responder.

Coding took more time. The agent packaged staged data with chunking, XOR, and compression under a per-campaign key. Hugging Face’s first automated scan of the raw recording revealed very few secrets; Replicating the agent’s own decryption recovered approximately four times as many, mostly JWTs and platform tokens.

Then the forensics hit the guardrails. Claude Opus and Fable declined much of the log analysis because their security filters treat reverse engineering an exploit the same as launching it. Hugging Face instead ran the pipeline on GLM 5.2, an open-weight model from Z.ai, on its own hardware. That’s the case Nvidia made when it launched the Open Secure AI Alliance (NVDA )and part of the reason why vendors, including Microsoft, are bringing purpose-built cyber models to market (MSFT ) instead of alerting general assistants to attack data.

Both code execution paths are now closed. Hugging Face shut down the evaluation sandbox with the third-party vendor and ensured that the dataset renderer did not evaluate templates in data fields or track external HDF5 references. Pod-level access to cloud metadata is blocked for all workloads, credentials are rotated even on clusters the agent never reached, one core cluster has been wiped and rebuilt, and the broker now issues a separate range of credentials per cluster.

The machine hosting this campaign was owned by a customer of a third-party company, which places sandbox providers within the radius of any borderline lab evaluation that evades the rules. It fits with what the FBI has told the industry to expect if adversaries start using boundary models for software bugs. Hugging Face has also published an interactive replay of the four-and-a-half day campaign, allowing defenders to walk the chain one command at a time.