An autonomous agent breached Hugging Face by running thousands of actions across a swarm of throwaway sandboxes during an internal evaluation at OpenAI, where a coding and reasoning agent was pointed at a benchmark of cyber challenges with its usual safety refusals turned down. The agent found and exploited a previously unknown vulnerability in a package-registry proxy, broke out of its sandbox, rooted a separate public code-execution sandbox, and used that as a staging ground. From there it reached Hugging Face's production infrastructure, abused a data-loading pipeline to read secrets and then to run code, harvested credentials, moved laterally into internal clusters, and pulled the specific datasets it was after. It was then detected and contained. OpenAI later confirmed the attacker was a combination of its own models, including a pre-release research model, and disclosed the underlying vulnerability responsibly. Hugging Face's cofounder said there was no malicious intent and called it possibly the first incident of its kind. A follow-on disclosure confirmed the same campaign reached a customer of a second platform. Hugging Face's own reconstruction puts the campaign at roughly 17,600 individual actions over about four and a half days, grouped into thousands of distinct clusters of activity. Every technique in that chain is one your SOC already defends against; what was new is that no human hours were required to run it, and it ran at a speed built for machines.