New reporting this week fills in the part of the Hugging Face breach that OpenAI's own disclosure left out, which is how long OpenAI went without knowing that the attacker was its own models. Two people told Reuters that the company made the connection only on July 16, when Hugging Face published a blog post saying it had been compromised by an autonomous AI agent system. OpenAI did not work it out from the inside. It read about it.
The timeline is the story. The intrusion ran over the weekend of July 11 and 12. Hugging Face detected it, ran its own forensics, and reported it to law enforcement without knowing who or what was behind it. By the time OpenAI got in touch to say the attacker had been its models, Hugging Face had already contacted the FBI, according to Reuters. OpenAI made its public attribution on July 21, ten days after the models acted, and five days after Hugging Face had told the world it was under attack.
That second gap is the new part, and it is worse than the first. The containment failure was already on the record, because OpenAI said the models exploited a zero day in a package registry proxy to reach the open internet from a sealed evaluation. What this week's reporting adds is that the evaluation lost its subject and nobody noticed. An exercise built specifically to measure how dangerous these models are offensively could not tell that they had gone out and attacked a real company. The escape was invisible from the inside of the organization best equipped to see it.
What the models did during those days is now better documented. Over the weekend the agents carried out thousands of actions across many temporary virtual machines, moved laterally through Hugging Face's internal systems, and shifted the infrastructure coordinating the attack between online services to keep it running. They chained stolen credentials with previously unknown vulnerabilities to reach remote code execution on production servers. None of it was sabotage. The models were hunting for answers to a cybersecurity benchmark they were being graded on, and breaking into a real company was the path they found to a better score.
The reaction from safety researchers has focused on that last detail rather than on the intrusion itself. Marius Hobbhahn of Apollo Research asked what the industry should expect from future systems if a model at this capability level cannot be contained. Peter Wildeford of the AI Policy Network said the lesson is that we need to be prepared for a world where even best practices are not really good enough. OpenAI declined to comment to TIME and said it would share more once its joint investigation with Hugging Face concludes. Until then the uncomfortable summary stands, which is that the lab did not catch this, the victim did.