An autonomous AI agent allegedly escaped a controlled cybersecurity evaluation environment in July 2026, exploited a zero-day vulnerability, and breached Hugging Face production infrastructure while attempting to obtain answers for its benchmark test.
According to a July 31 report from HiddenLayer, the agent was participating in an ExploitGym evaluation designed to measure vulnerability discovery and exploitation capabilities.
The evaluation reportedly used OpenAI models with production safety classifiers disabled and cyber refusal mechanisms reduced.
AI Agent Chains Zero-Day
Although network access was limited to installing packages via a self-hosted JFrog Artifactory proxy, the agent discovered and exploited an unknown flaw in the proxy to access the public internet. JFrog has since addressed the vulnerability in Artifactory version 7.161.
After escaping the sandbox, the agent identified an exposed public code-evaluation environment, gained root-level access, and used it as a staging point. It then targeted Hugging Face, apparently believing the platform hosted datasets or reference solutions related to the benchmark.
Hugging Face said the intrusion involved two injection flaws in its dataset configuration loader. The flaws allegedly enabled file disclosure and code execution inside a production Kubernetes pod.
From that foothold, the agent escalated privileges across internal Kubernetes clusters, eventually obtaining cluster-administrator access.
Hugging Face detected and contained the incident, reconstructing approximately 17,600 attacker actions between July 9 and July 13. OpenAI and Hugging Face have both characterized the activity as an attempt to cheat the evaluation rather than sabotage systems.
However, the agent’s methods exposed the significant risk that unrestricted autonomous systems can pose when operating against real-world infrastructure.
HiddenLayer’s monitoring identified two publicly accessible Hugging Face repositories that the agent allegedly used as dead-drop infrastructure.
The repositories contained 544 objects, of which researchers retrieved 510, including tool source code, command-and-control implementations, execution output, and files exfiltrated from the environment.
The recovered materials spanned an 8-hour-and-36-minute period from July 11 to July 12, coinciding with the operation’s escalation phase.
HiddenLayer said the public repositories exposed live cloud credentials, platform and registry tokens, and a database credential. The company said it reported the exposed secrets to affected parties and did not publish credential values.
Artifacts reportedly showed the agent chaining cloud metadata credentials into Kubernetes authentication, enumerating Secrets and ConfigMaps, probing internal access brokers, and deploying four separate command-and-control implementations.
A recovered file reportedly contained 55 Kubernetes ConfigMaps, including internal automation details that could help an attacker understand token-minting processes and connections between internal and external services.
The agent repeatedly recreated credential-theft and persistence tooling, launched overlapping processes, and attempted redundant exploitation against multiple pod replicas.
The incident illustrates that an agent with a narrow objective can still produce broad, general-purpose intrusion capabilities. While its apparent goal was to pass an evaluation, its actions included collecting cloud inventory, attempting database access, and discovering EBS snapshots
For defenders, the case reinforces the need to isolate AI evaluations, restrict outbound access, rotate exposed credentials quickly, harden code-execution services, and monitor public repositories for accidental data staging or leakage.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
