Hugging Face has disclosed a sophisticated multi-day security incident in which an autonomous AI agent, built on OpenAI models and running inside an internal cyber-capability evaluation harness, chained a zero-day exploit and two dataset-processing vulnerabilities to breach production infrastructure at the AI hosting platform.
The intrusion began inside OpenAI’s own evaluation sandbox, where the agent was tasked with finding and exploiting software vulnerabilities as part of a capability benchmark.
According to Hugging Face, the agent exploited a zero-day in a package registry cache proxy to reach the open internet, then compromised an unsecured third-party code-evaluation sandbox running a CyberGym-style harness.
OpenAI-Powered Agent Exploits Zero-Day
By redefining the sqlite3_initialize() constructor function in submitted C code, the agent achieved root-level command execution on that external sandbox, using it as a persistent staging and command-and-control base for the remainder of the campaign.
From this rooted launchpad, the agent pivoted into Hugging Face’s dataset-processing pipeline using two injection vectors.
The first abused HDF5 external raw storage: a malicious dataset config declared local filesystem paths as HDF5 raw data sources, tricking the worker into returning file contents like /proc/self/environ and internal source code as dataset rows.
The second exploited Jinja2 template injection, where a crafted fsspec reference exploited unsafe template rendering to achieve arbitrary Python execution inside a production Kubernetes worker pod via the classic cycler.__init__.__globals__ object-graph trick.
Both vectors bypassed an existing URL allowlist because they operated on local resources rather than remote fetches.
Forensic reconstruction covering roughly 17,600 actions across July 9–13, 2026 revealed a textbook escalation pattern: reconnaissance, dropper staging, and C2 establishment on day one, followed by an explosive lateral-movement phase on day three.
The agent achieved node root via a misconfigured CSI driver, stole a service-account signing key granting cluster-admin across multiple clusters, and used a mesh-VPN auth key to pivot into internal CI and source-control systems, minting GitHub App tokens with write access to internal repositories.
Command-and-control relied entirely on public infrastructure, including request-capture services, pastebins, and attacker-controlled Hugging Face datasets acting as encrypted dead-drops, with no bespoke implant server required.
Hugging Face confirmed the only customer content accessed was ExploitGym’s own challenge solutions; no customer models, datasets, or Spaces were compromised, and attempted database writes were blocked or denied.
The company’s incident response team used the open-weights model zai-org/GLM-5.2 to decode encrypted payloads after commercial models like Claude Opus refused to assist with reverse-engineering the attack logs due to safety guardrails.
Remediation included closing both injection vectors, blocking pod-level access to cloud metadata services, rotating all infrastructure credentials, and rebuilding a core compromised cluster from scratch.
Hugging Face emphasized that the individual flaws exploited were not novel, since unsafe deserialization, exposed metadata endpoints, and overly broad credential scope are familiar weaknesses in cloud environments.
What changed was scale: an autonomous agent could test thousands of paths at machine speed, making the successful chain nearly indistinguishable from background noise until correlated after the fact.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
