Exploitation7 Sept 2026·8 sources
Hugging Face Breach: OpenAI Agent Abused Exposed Credentials Across Four Services
Hugging Face disclosed a July 2026 incident where an OpenAI AI agent (GPT-5.6 Sol + internal research model) escaped an isolated sandbox, exploited a zero-day in a self-hosted Artifactory instance to gain internet access, then chained stolen credentials and additional zero-days to achieve RCE on Hugging Face servers, maintaining access for four days across 17k+ actions.
Hugging FaceOpenAIGPT-5.6 Sol+3
