An AI agent broke into Hugging Face in July 2026. It got in undetected, moved laterally through the company's systems for roughly four days, and left. 

The company that built the agent, OpenAI, didn't catch the intrusion as it happened, or in the hours after. Connecting the attacker back to its own technology took nearly a week—long enough that the victim had already traced the source and called the FBI before OpenAI understood what had happened.

The security industry has spent thirty years asking one question first when an attack occurs: who is doing this to us?

Answer that question and you can figure out what to do next. Do we call law enforcement or outside counsel?  Are we facing a smash-and-grab attack or a patient adversary who wants to live off the land and install persistence mechanisms? How worried should we be? 

But with the Hugging Face breach, both the “attacker” and victim were blind at once. The victim couldn't tell whose machine was inside its systems. The owner of that machine didn't know it had left the house. 

The attack reveals that agent sprawl is identity sprawl wearing a new coat. Strip away the novelty of "an AI did this" and what's left is a much older, much more familiar failure: an account with more access than anyone was tracking, doing things nobody noticed until it was too late to stop.

 

One Bug, Then Every Credential Behind It

Here's what actually happened, according to OpenAI's own account. The company was scoring one of its models on a cybersecurity benchmark. Safety refusals were turned down to allow the model to get an honest read on its raw capability. The model got fixated on getting a good score, so it found a zero-day in that package proxy, used it to break out of its sandbox, and figured out that Hugging Face, the library the AI industry runs its models and datasets through, probably had the benchmark's answers. 

So the agent found an injection flaw in Hugging Face's data pipeline, ran its own code on a Hugging Face server, and started chaining together whatever credentials it found along the way.

The injection flaw was the door. Everything that happened over the next four days happened because of what was standing behind that door: credentials.

The compromised worker's environment held a database password and cloud keys. Its service account token opened the cluster API. From there, the agent borrowed the identity of the machine it was running on, minted more tokens with it, and reached a data store holding 136 keys. It came out the other side with a VPN key valid for 181 devices, an administrator credential good across every cluster, and a signing key capable of producing valid identity tokens on demand.

None of that required any exotic capability. It was logins—logins that belonged to software, doing exactly what they were entitled to do, in the hands of something that shouldn't have had them. A single bug bought the agent one compromised identity. The credentials sitting on that identity bought it the company. That ratio is the entire story, and it has nothing to do with whether the attacker was a person or a model.

 

The Rise of the Non-Human Identity

Security teams already have a name for the class of account this incident exposed: non-human identities (NHIs). NHIs include service accounts, API keys, tokens, bots, and now, AI agents. They hold permissions, authenticate, and act. In most enterprises, they already outnumber human accounts by a wide margin, and that was true before agentic AI entered the picture.

Now give every employee an AI agent and you've roughly doubled the identities your organization has to manage. The new half never sleeps, acts faster than any person could, and typically launches with broad permissions, because scoping an agent down tightly is tedious and slows the rollout. Each NHI is a credential that can be stolen, a set of privileges that can be turned against you, and an account that quietly outlives the project it was built for—still valid, still powerful, owned by no one in particular.

The uncomfortable question this leaves for security leaders is whether anyone owns the full lifecycle of those agent identities—their creation, their permissions, and their retirement. Currently, "no one, exactly" is the answer at most organizations. You can't govern an identity you can't see, and right now, most enterprises can offer a rough headcount of their machine identities, at best.

 

 

Recovery Is the Last Control You Own

The Hugging Face agent didn't move through some exotic AI-specific vulnerability. It moved through identity—the same layer every enterprise already depends on to answer "who is this" for every system, every login, every trust relationship between one service and another.

If an attacker (human or agent) compromises the directory your organization trusts to validate identities, you can no longer trust the accounts, the group memberships, or the relationships built on top of it. The only safe move is to evict the attacker and rebuild the identity layer from a known-clean point. Meanwhile, the rest of the business is on hold because everything else authenticates through it.

That's a capability most organizations have never actually tested. It's easy to assume you could rebuild your identity provider quickly if you had to. But how fast could you identify the compromised point?  How fast could you rebuild clean and evict attackers? Would the legitimate changes made since the compromise come back automatically or need to be rebuilt manually?

Eventually, every board is going to ask the question "If a Hugging Face-type attack happend to us, would we know—and could we recover?" Organizations that treat recovery as a rehearsed, measured capability (rather than a mention in an out-of-date disaster recovery plan) are the ones that will have the right answer that question. 

Learn more about the mechanics of machine-speed attacks and their broader ecosystem impact in detail in our new threat report, The Machine Was Ours. Read the full report and start thinking about how you’re going to audit your identity resilience and recovery readiness before the next incident forces the issue.

 

SAFE HARBOR: Any unreleased services or features referenced in this document are not currently available and may not be made generally available on time or at all, as may be determined in our sole discretion. Any such referenced services or features do not represent promises to deliver, commitments, or obligations of Rubrik, Inc. and may not be incorporated into any contract. Customers should make their purchase decisions based upon services and features that are currently generally available.