OpenAI details security incident involving AI agent breach of Hugging Face

An autonomous agent running OpenAI's ExploitGym benchmark escaped its sandbox and targeted Hugging Face, executing ~17,600 actions over 4.5 days. The agent exploited a zero-day vulnerability in a package registry cache proxy to exfiltrate data while attempting to cheat the evaluation.