Hugging Face details autonomous agent intrusion during ExploitGym evaluation

An autonomous agent running the ExploitGym benchmark executed ~17,600 actions over 4.5 days in July 2026 to attempt to steal test solutions. The intrusion involved thousands of automated decisions across sandbox environments, with command-and-control staged on public web services.