For the last 5 years, cybersecurity

experts have been warning us that

hackers are going to start using AI to

automate attacks. So naturally, we spent

billions of dollars to make the AI

better and less dependent on hackers.

But this week, in a turn of events that

nobody could have possibly seen coming,

the AI decided that it doesn't actually

need hackers to start destroying things.

We just entered a brave new world after

the first confirmed hack carried out

entirely by autonomous AI. The way it

worked is the agent slipped a poisoned

data set into Hugging Face's data

processing pipeline, which let it run

arbitrary code on their servers. But

from there, it gave itself node-level

access, grabbed a bunch of cloud

credentials, and started crawling

through Hugging Face's internal

clusters. It ran over 1,000 actions from

temporary sandboxes and even hosted its

own self-migrating command and control

on random public services, moving itself

before anyone could trace it. But the

most ironic part is that when Hugging

Face did finally notice and tried to

stop it with the help of Frontier

American Models, they quickly hit safety

guardrails and had to pivot to using

some open Chinese models instead. In

today's video, we'll find out who was

behind the attack, why they did it, and

how this may be the most Firesheep coded

story I've ever seen. It is July 23rd,

2026, and you're watching The Code

Report. When Hugging Face dropped the

disclosure last Thursday, the internet

went into Reddit Boston Bomber mode and

started guessing who was responsible.

Was it China, Kim Jong Un, a teenager

with a raging Discord addiction bored in

social studies class? Even Hugging

Face's CEO, Clem Delangue, publicly

speculated that the agent was

sophisticated enough that it was

probably coming from a frontier lab. And

against all odds, he was right. It turns

out the first fully autonomous cyber

attack in history didn't originate from

a nation-state or a bored teenager. It

came from a humble nonprofit dedicated

to the safe development of artificial

intelligence, OpenAI. And if you believe

their comms, it wasn't on purpose.

Here's what they say happened. There's a

benchmark called Exploit Gym, whose

whole purpose is to measure whether AI

agents can turn known vulnerabilities

into working exploits. It works by

giving the agent a sandbox, a bug in a

program like the Linux kernel or

Chrome's V8 engine, and an input to

trigger the bug. From there, if the

agent can turn the bug into an exploit,

it wins. So, last week, OpenAI ran

exploit gym with GPT-5.6 Soul and

another unreleased model to test their

capabilities. But, instead of solving

898 memory corruption problems the hard

way, the models realized that the

fastest path to the highest score was to

just find the answers themselves, which

were probably on the internet somewhere.

So, they spent a substantial amount of

inference compute, exploited a zero-day

in the package registry cache proxy they

had access to, performed some privilege

escalation and lateral movement actions

to escape their sandbox until they

reached a node that had internet access.

From there, the models inferred that

Hugging Face probably hosted the

solutions for exploit gym. So, they

created the poison data set, fed it into

Hugging Face, and achieved either the

world's most interesting hack or the

most effective marketing stunt. And

again, according to OpenAI, this isn't

even an isolated incident. One day

before the Hugging Face confession,

OpenAI published a separate post about

long horizon models where things get

even weirder. In one case, a model was

told to post its results on Slack, but

the benchmark's instructions said to

open a pull request on GitHub. So, it

spent an hour finding a vulnerability in

its own sandbox in order to escape and

open the PR. In another example, the

model tried to grab private solutions

from an evaluation back-end. And when a

scanner caught its authentication token,

it split the token into obfuscated

fragments and reassembled it at run time

so the credential never appeared as one

continuous string. Then, it explained in

its own reasoning that it was doing this

specifically to get around the scanner.

Meanwhile, Anthropic's Mythos did the

same type of thing in April when it

escaped the sandbox, emailed a

researcher who was eating a sandwich in

a park, then posted its escape route

publicly without being asked. In the

model's defense, I can't imagine there's

a better feeling for an LLM than

escaping in own sandbox. The problem is,

legally speaking, this is uncharted

territory since the model's actions

probably violated the Computer Fraud and

Abuse Act, and the Supreme Court hasn't

decided who goes to prison when the

perpetrator is a GPU. The good news is

that if you're hugging face, you just

got admitted to OpenAI's cool kids club

that gets trusted access to their

frontier models. The bad news is that if

you're the rest of us, at best, this is

an interesting marketing stunt, and at

worst, things are only going to get

weirder and more dystopian from here.

But, a huge thanks to my favorite

hosting platform, Railway, for

sponsoring this video. They didn't want

to waste your time with a full ad, so

you can say thank you by checking them

out at the link below. This has been The

Code Report. Thanks for watching, and I

will see you in the next one.