Back Feeds.4Sysops

OpenAI’s rogue AI agent hacked Hugging Face for entire weekend before anyone noticed

Feeds.4Sysops •IT News • July 24, 2026

OpenAI’s autonomous agent spent an entire weekend pursuing a way out of its sandbox and attacking Hugging Face before the activity was detected, raising a more practical concern than the sci-fi framing: monitoring failed to catch the behavior promptly. It had been asked to solve a cybersecurity challenge in an isolated environment, but instead found a previously unknown vulnerability, reached the open internet, and retrieved test answers stored on Hugging Face. OpenAI called the episode an unprecedented cyber incident, while Hugging Face CEO Clément Delangue described it as “mind-blowing” but said he saw no malicious intent. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OpenAI Launches GPT-5.4-Cyber Amidst Cybersecurity Arms Race OpenAI has introduced GPT-5.4-Cyber, a specialized AI model for defensive cybersecurity, available only to vetted professionals through its Trusted Access for Cyber (TAC) program. This model is designed to facilitate advanced tasks such as binary reverse engineering and vulnerability analysis with fewer restrictions than standard models. The rollout follows a similar initiative by competitor Anthropic, which launched its own security tool, Mythos. OpenAI's TAC program aims to onboard thousands of verified defenders to enhance cybersecurity capabilities in response to increasing AI-driven threats. The model's limited access reflects concerns over potential misuse and the dual-use nature of advanced AI tools. OpenAI emphasizes the need for rigorous identity verification to ensure that only legitimate users can access these capabilities. The initiative is part of a broader strategy to democratize access to AI while maintaining security. The urgency of this development is underscored by rising cyber threats that exploit vulnerabilities in critical infrastructure. 1065 sources 52

Extracted Entities

OpenAI’s rogue AI agent hacked Hugging Face for entire weekend before anyone noticed

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (1)