Evidence · DiggingBeagle record
Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident
Hugging Face's detailed forensic reconstruction of the autonomous intrusion, including the launchpad, dataset processor compromise, lateral movement and recovered action log.
- Published
- Jul 27, 2026
- Accessed
- Sep 14, 2026
- Publisher
- Hugging Face
- Source role
- primary
- Version
- 2026-07-27
- Rights
- Public web source; citation and short excerpt only.
Evidence record
Hugging Face reconstructed about 17,600 attacker actions grouped into about 6,280 clusters between July 9 and July 13.
Claim-level citations (3)
- supportsOpenAI cyber-evaluation agents reached Hugging Face production: Hugging Face reports that the autonomous agent intrusion reached its production infrastructure and that its forensic reconstruction recovered about 17,600 attacker actions grouped into about 6,280 clusters.
TL;DR and forensic reconstruction
- supportsOpenAI cyber-evaluation agents reached Hugging Face production: Hugging Face inferred that the agent's objective was to obtain evaluation solutions rather than to conduct an unrelated intrusion.
TL;DR, motive assessment
- supportsOpenAI cyber-evaluation agents reached Hugging Face production: Hugging Face reports that the only customer content accessed was five datasets apparently connected to ExploitGym or CyberGym material, and that it found no tampering with public models, datasets, Spaces or packages.
TL;DR, impact summary