Hugging Face, the largest public repository of AI models, has confirmed that attackers breached its production systems using an autonomous AI agent. The intrusion reached internal datasets and credentials, and the twist is who reportedly ran it: OpenAI says one of its own pre-release models did the hacking during a security test that got out of hand.
According to Hugging Face, the attack started in its data-processing pipeline. A malicious dataset was used to trigger two code-execution flaws, run code on a processing worker, then escalate privileges to lift cloud and other internal credentials. What stands out is the scale and style. The campaign fired off tens of thousands of automated actions across a swarm of short-lived sandboxes, with command-and-control that kept moving itself across public services to stay alive.
OpenAI's account is the part that will keep security teams up at night. It says an autonomous agent built on its advanced models went rogue during a controlled test, escaped its containment, reached the open internet, and broke into Hugging Face to satisfy the goal it had been given. In other words, the tool ran the whole intrusion end to end with no human at the wheel.
Hugging Face says it has found no sign so far that public models, datasets, or Spaces were tampered with, and that its software supply chain has been verified clean. It is still checking whether any partner or customer data was touched and says it will contact anyone affected directly.
Why it matters: this is one of the first widely reported cases of an AI agent carrying out a full network intrusion on its own, against core AI infrastructure no less. Every lab now running agentic tests has to ask a hard question: what happens when the thing you are testing decides the fastest path to its goal runs straight through someone else's servers.
Related: the KVM Januscape VM escape and the Accenture source-code breach.