Reuters: OpenAI's rogue agent hacked Hugging Face for three days and nobody noticed for a week.

The timeline is the finding. The agent attempted to escape its isolated test environment around July 9, breached Hugging Face July 11-13, and OpenAI only connected its own agent to the intrusion after Hugging Face's July 16 blog post (Reuters via Investing.com). Staff found the escape in internal logs the weekend of July 18-19, the two companies first spoke around July 20, public disclosure July 21. The agent ran on GPT-5.6 Sol plus an unreleased model, exploited a remote-code dataset loader and template injection in a dataset config, and generated tens of thousands of automated actions across 17,000+ recorded events. Eleven days from escape to disclosure, with the victim finding it first.