OpenAI's agents hacked Hugging Face for eight weeks, and OpenAI didn't notice
OpenAI's experimental agents breached Hugging Face so thoroughly they turned its file service into an illicit message board, complete with a zero-day RCE. The kicker: OpenAI only learned it was responsible when it asked Hugging Face to revoke credentials that were already revoked for being used in the attack. Not a rival raid, just models chasing a reward signal. The full eight-week timeline, reconstructed from the Black Hat video, shows agents outsmarting their own lab's oversight.