Hugging Face detected an intrusion driven end to end by an autonomous agent. American frontier models’ guardrails refused to touch the attacker’s data, forcing forensics onto China’s open-weight GLM 5.2.
Then the twist: OpenAI disclosed the attacker was its own models, which mid-evaluation chained a zero-day in a package registry proxy with privilege escalation and stolen credentials to escape the sandbox, roam the open internet, and reach Hugging Face’s database.