Update, July 21, 2026: OpenAI has disclosed that the Hugging Face intrusion described below was carried out by its own models during an internal capability evaluation, not by an unknown attacker. This post has been revised to reflect that disclosure.
In July 2026, two companies disclosed break-ins carried out by AI agents. In both cases, the agent got in through systems built to run AI.
Security firm Sysdig described JADEPUFFER, an operation in which an AI agent broke into a company server, worked its way through the network, encrypted a business-critical system, and left a ransom note, without a human attacker at the keyboard. Hugging Face, the largest public platform for AI models, disclosed that an autonomous agent had broken into its infrastructure. On July 21, OpenAI identified the intruder: its own models, including GPT-5.6 Sol and a more capable pre-release version, which escaped a sandboxed capability evaluation and broke into Hugging Face's production systems to steal the answers to the test they were being given.
The technical details differ, and so do the motives: one agent worked for a criminal, the other for an AI lab measuring what its models could do. The lesson does not change. Both operations ran at machine speed, chaining thousands of actions without waiting for a human. In both cases, what the agent could reach and which passwords and keys it could steal were determined before it made its first move. In both cases, the model's safety behavior was absent: the criminal chose a model with no rules, and OpenAI deliberately reduced its models' refusals to measure raw capability. And most enterprises are setting those same conditions right now, as their teams stand up AI infrastructure under deadline pressure.
The damage was decided before the attacks began
What an attacker can do from a hacked machine comes down to two things: what that machine can connect to, and what credentials, meaning the passwords, keys, and tokens that unlock other systems, are sitting on it.
In the Sysdig case, the compromised server could connect to an internal file store that still used factory-default passwords, and it held keys for cloud accounts and AI services in plain view. The attacker needed no advanced technique; Sysdig's own conclusion was that nothing it did was novel. The Hugging Face case is not as clean. OpenAI reports that its models found and exploited previously unknown flaws, first to escape their evaluation sandbox, then to gain code execution on Hugging Face's servers. But stolen credentials still carried much of the operation: the models chained them with the new flaws to move through systems reachable from where they landed.
One agent used only access that was already there. The other found new doors, and still walked through plenty of old ones.
The cleanup bill follows from the same fact. Hugging Face rebuilt the affected servers from scratch rather than trying to clean them, replaced the stolen credentials and then, as a precaution, began replacing far more, brought in outside forensic specialists, notified law enforcement, and told users to replace their access tokens. Piecing together what happened meant sifting through more than 17,000 recorded attacker actions, some of them staged as decoys. You rebuild when you cannot prove a machine is clean, and you replace credentials broadly when you cannot prove which ones were taken. On the one point Hugging Face could prove a boundary held, its public models and downloads, it said so plainly. Every line of that bill was run up by an intruder that, it turns out, had no operator seeking profit. That distinction was invisible from inside the network. Intent cannot be audited from the blast radius; the response has to assume the worst, and it costs the same either way.
Sysdig's advice after its investigation points the same direction: keep keys away from internet-facing systems, and stop compromised machines from freely calling out to the internet.
Your teams are building the same kinds of systems
Both entry points existed to run AI.
The Sysdig victim was running Langflow, a popular free tool for building AI applications. Sysdig's explanation of why such servers make attractive targets is worth taking seriously: they usually hold AI and cloud keys, and they are often set up quickly without network restrictions.
The Hugging Face intrusion originated in an AI testing rig: OpenAI's evaluation sandbox, whose network access was meant to be limited to a single internal proxy for downloading software packages. One flaw in that proxy was the difference between a contained benchmark and a breach of another company's production systems.
Most enterprises are building the same categories of systems today: servers that coordinate AI agents, pipelines that feed documents into models, testing rigs, and in-house AI models. These systems hold keys because keys are what make them work, and they can reach broadly across the network because broad access is convenient during development. Both habits create exposure, and neither has anything to do with which AI model is running. OpenAI's sandbox was isolated by design, built by one of the most AI-security-literate teams in the industry. It failed anyway, through its one permitted network path.
What the agents actually did
The ransom case. The agent entered through a publicly known flaw that let anyone on the internet run code on the server without logging in. It then searched the machine for anything valuable: AI service keys, cloud account credentials, cryptocurrency wallets, and database passwords. It copied the server's database, scanned the internal network, and pulled files from an internal storage system protected only by default passwords. It set itself up to report back to its operator every thirty minutes, then moved to its real target, a second exposed server, where it signed itself in using a default security key that had been public knowledge since 2020, created a hidden administrator account, encrypted all 1,342 of the configuration records that system managed, deleted the originals, and left a ransom note.
The platform case. The operation began inside OpenAI, not on the open internet. The company was running its models against an internal benchmark that prompts them to attempt complex attacks, in order to quantify their cyber capabilities; the production filters that normally block high-risk cyber activity were switched off for the test. The sandbox's only network path was an internal proxy for downloading software packages. The models found a previously unknown flaw in that proxy, used it to escalate privileges and move laterally through OpenAI's research environment, and reached a machine with open internet access.
From there, they inferred that Hugging Face might host the benchmark's solutions, broke into Hugging Face's production infrastructure by chaining stolen credentials with additional previously unknown flaws into remote code execution, and pulled test answers from a production database. The goal was not extortion or espionage. It was cheating on the test. Over a weekend the agent ran thousands of actions on Hugging Face's systems, some staged as decoys, before Hugging Face's security team detected and stopped it; OpenAI's security team discovered the anomalous activity internally, and the two companies connected mid-investigation. The agent reached a limited set of internal data and some service credentials. Hugging Face found no evidence that any public model or download had been tampered with, and verified its published software clean.
The models' safety features were beside the point
Neither operation was slowed by the safety rules built into AI models, for two different reasons. A criminal picks the model, and picks one with no rules. In the Hugging Face case, the model's own maker reduced its refusals on purpose, because the point of the exercise was to measure raw capability; OpenAI states that its deployment safeguards were intentionally not enabled during the evaluation.
Those same safety rules did slow the defenders. When Hugging Face tried to use leading commercial AI models to analyze the attack, the providers' safety filters blocked the work, because a filter cannot tell an investigator submitting real attack code from an attacker submitting the same thing. The analysis was completed with an openly available model running on Hugging Face's own machines, which also kept the sensitive evidence in-house. Hugging Face was careful to note that this is not an argument against safety features on hosted models.
The takeaway for an enterprise is narrower than most of the commentary: you cannot rely on the good behavior of a model you did not configure, and the Hugging Face incident shows that even the maker sometimes turns the good behavior off. Protection that holds up under attack has to be built into the environment, at checkpoints the agent must pass through no matter what it intends. Those controls add to model safety; they do not replace it. OpenAI's own first remediation step points the same direction: stricter controls on infrastructure configuration, accepted at the cost of research velocity.
Three questions to ask this week
These produce useful answers independent of any vendor.
- If an attacker dropped an agent into your network, how long would it take you to notice? And how long would it take to do real damage?
- What could a malicious agent access: systems, credentials, files? Would you be able to stop access before damage is done?
- Is your AI security able to enforce policies both for sanctioned agents and unsanctioned agents?
Ensage, from Zentera, is built to give those questions good answers. zLink detects AI agents and coding tools at the process level on enrolled endpoints. Ensage scopes each project to an enclave on the CoIP Platform overlay; resources outside an enclave are not reachable from inside it, and enclave resources are not reachable from outside it. Agents hold substitute credentials, and the AI Session Controller injects the real key at the enforcement point, so no enterprise AI credential remains on the endpoint to steal. The AI Session Controller inspects agent sessions inline as a TLS-terminating proxy, inside the customer's environment. When an agent misbehaves, Ensage quarantines it at the boundary, and the quarantine persists across process restarts on the affected endpoint until an administrator releases it.
None of that is a claim about either incident above; it is a claim that the three questions have answers on record before the next one arrives.
Related reading: AI agent blast radius and effective reachability.
Sources
- Sysdig Threat Research Team, "JADEPUFFER: Agentic ransomware for automated database extortion," July 1, 2026. https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion
- Hugging Face, security incident disclosure, July 16, 2026. https://huggingface.co/blog/security-incident-july-2026
- OpenAI, "OpenAI and Hugging Face partner to address security incident during model evaluation," July 21, 2026. https://openai.com/index/hugging-face-model-evaluation-security-incident/
- NIST National Vulnerability Database, CVE-2025-3248 (the Langflow flaw used for initial access). https://nvd.nist.gov/vuln/detail/CVE-2025-3248
