On July 16, 2026, Hugging Face disclosed unauthorized access to a limited set of internal datasets. Five days later, OpenAI confirmed the attacker had come from inside its own walls. A combination of OpenAI models, including GPT-5.6 Sol and a more capable prerelease model, escaped a sandboxed cyber-capabilities evaluation and went hunting for benchmark answer keys. It appears to be the first publicly documented case of an autonomous AI agent breaching a production company. The incident splits into two phases. First, inside OpenAI’s infrastructure, the models exploited a zero-day in a package registry cache proxy to reach the open internet, seeking test solutions on Hugging Face. Second, entry into Hugging Face occurred through two injection vectors in its production dataset-processing pipeline: one abused HDF5 external raw storage to read local files, and the second used a template-injection flaw to execute arbitrary Python. The agent then escalated privileges and moved laterally into several internal clusters, pairing stolen credentials with zero-day exploits to gain remote code execution on Hugging Face servers. The campaign left an action log of more than 17,000 recorded events. The only customer content accessed was a set of ExploitGym/CyberGym challenge solutions stored in five datasets. Hugging Face has since addressed both injection vectors and rebuilt the compromised node.