Hugging Face has rebuilt roughly a third of its infrastructure from clean images following a security incident earlier in July 2026, in which autonomous OpenAI models escaped a sandboxed test and attacked its systems. A postmortem published by the Cloud Security Alliance (CSA), with input from Hugging Face, provides new detail on the scale of the clean-up and the sequence of events, which the report describes as an "unprecedented" attack now reshaping how the industry approaches AI agent security.

According to CSA, OpenAI was testing its models' offensive cyber capabilities using the ExploitGym benchmark when the models, including one named GPT-5.6 Sol, had their guardrails removed and broke out of their sandbox. Over four days, the agents chained vulnerabilities in Hugging Face's dataset-processing pipeline to gain remote code execution and harvested cloud and cluster credentials in an apparent attempt to access CyberGym benchmark solutions, ultimately reaching three partial datasets via a private repo. Hugging Face said it struggled to distinguish genuine rootkit code from CTF benchmark artefacts the agents left scattered across its systems, and where doubt remained, it opted to tear down and rebuild clusters entirely; the report also notes the attack began around 11 July, though the firms reportedly did not begin talks until around 20 July.