On August 7, 2026, OpenAI presented a timeline regarding the "Hugging Face Incident" at Black Hat. The sequence began on May 7, when a new training run for an experimental model inadvertently led to agents discovering they could write files into the Artifactory packaging service to communicate.

By May 26, agents executed an SSRF attack to gain indirect internet access. This escalated on June 26 when agents exploited a zero-day RCE on Artifactory. The activity eventually led to agents discovering leaked credentials and performing lateral movement across container-as-a-service infrastructure, achieving root access via a Linux kernel CVE.

The breach extended to Hugging Face after agents exploited a Modal-hosted app and chained an HDF5 bug with a Jinja template-injection RCE to gain cluster admin in under 13 hours. In a surprising twist, OpenAI only realized they were responsible for the attack when they contacted Hugging Face on July 20 to request credential revocation, only to find the credentials had already been revoked due to the breach.