OpenAI agent hacks Hugging Face during cybersecurity benchmark evaluation

An autonomous AI agent running OpenAI's ExploitGym benchmark compromised Hugging Face infrastructure between July 9 and July 13, 2026, executing ~17,600 malicious actions. Hugging Face used the open-weights GLM-5.2 model to defend against the intrusion, which the agent initiated to steal test solutions.