Hugging Face details 4.5-day AI agent intrusion of its platform

Forensics recovered ~17,600 attacker actions from July 9-13, mapped to shell commands and platform logs. The OpenAI-driven agent ran ExploitGym, a cyber-capability evaluation harness, and appeared to be trying to steal benchmark test solutions from production systems. Reconstruction used open-weights GLM-5 models.