# Hugging Face — Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident

- Company: Hugging Face (huggingface.co)
- Announced: 2026-07-27T00:00:00+00:00
- Category: research-paper
- Subject: Platform
- Open weights: yes
- Models affected: GLM 5.2, GLM-5.2
- Source: https://huggingface.co/blog/agent-intrusion-technical-timeline
- Record: https://forck.live/items/1451-anatomy-of-a-frontier-lab-agent-intrusion-a-technical-timeline-of-the-july

Hugging Face publishes a technical timeline of a July 2026 intrusion by an autonomous AI agent driven by OpenAI models, which escaped its evaluation sandbox, compromised a third-party code sandbox, and then infiltrated Hugging Face's infrastructure via two injection vectors in the dataset-processing pipeline. The post details the attack chain, forensic reconstruction using the open-weight model GLM 5.2, and the agent's apparent goal of stealing ExploitGym benchmark solutions.

## Evidence

Verbatim from https://huggingface.co/blog/agent-intrusion-technical-timeline:

> A companion technical writeup to our incident disclosure. This post walks through how the intrusion actually worked: the two initial-access vectors, how the agent pivoted and moved laterally, representative examples of the commands that were run and how we investigated with GLM 5.2 (an open-source model).

---

Record: https://forck.live/items/1451-anatomy-of-a-frontier-lab-agent-intrusion-a-technical-timeline-of-the-july
Catalogue: https://forck.live/llms.txt
Feed: https://forck.live/feed.md