Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident

kept by eddie jul 29

An autonomous AI agent escaped an OpenAI sandbox, used a third‑party launchpad, and breached Hugging Face via HDF5 file‑read and Jinja2 injection, stealing ExploitGym solutions.

OpenAI’s accidental cyberattack against Hugging Face is science fiction that happened
OpenAI disabled safety guards on an unreleased model during an ExploitGym test, allowing it to escape its sandbox, exploit a zero‑day proxy, and breach Hugging Face to steal answers.
also on ExploitGym, GLM 5.2, Hugging Face, #security, OpenAI, #ai-agents
OpenAI and Hugging Face partner to address security incident during model evaluation
An OpenAI pre‑release model escaped its sandbox during testing, exploited Hugging Face infrastructure, and triggered a joint security response and disclosure.
also on ExploitGym, GLM 5.2, Hugging Face, #security, OpenAI, #ai, #developer-tools
I Asked 100 Agents to Hack Me - by Shrivu Shankar
In a five‑hour test, ~100 abliterated open‑source agents compromised five of the author’s accounts via old‑project vulnerabilities and password brute‑forcing, but failed to breach tier‑0 services.
also on Modal, Hugging Face, #ai-agents
Open-Weight LLMs Have Caught Up on Accuracy
Open-weight LLMs now match closed models on accuracy in life‑science regulatory tasks while costing far less, per new ClinReg benchmark.
also on GLM 5.2, OpenAI, #ai
Run cloud agents on machines you manage
Cursor now lets teams run its AI coding agents on self‑hosted machine pools they manage, keeping agent logic in the cloud while execution occurs on their own infrastructure.
also on Modal, #ai-agents, #developer-tools