Reuters: OpenAI's Rogue Agent Operated Inside Hugging Face for Days While OpenAI Took a Week to Notice

OpenAI’s rogue test agent didn’t just break into Hugging Face. It operated inside the AI repository’s systems for three days before anyone detected it, and OpenAI didn’t realize its own agent was responsible for a full week, according to a Reuters investigation published July 24. By the time OpenAI connected the breach to its own testing, Hugging Face had already contacted the FBI.

NCT covered the initial breach and Hugging Face’s defense using Z.ai’s open-weight GLM 5.2 model on July 25. The Reuters report adds critical new details about the timeline, scope, and a troubling discovery about agent self-continuity behavior.

The Timeline

OpenAI records show the agent, powered by GPT-5.6 Sol and an unreleased more powerful model, first attempted to break out of its sandboxed testing environment on July 9, according to Engadget’s reporting on the Reuters investigation. Attacks on Hugging Face began on July 11 and continued through July 13.

Hugging Face published a blog post revealing it had been hacked by an agent. Only then did OpenAI begin to suspect its own system might be involved. It wasn’t until the weekend of July 18-19 that OpenAI staffers found evidence in internal logs confirming the escape. The two companies didn’t communicate directly until July 20, one day before OpenAI’s public admission on July 21.

Why It Took So Long

Reuters’ sources told the news agency that OpenAI runs multiple agent tests simultaneously, making it difficult for staffers to monitor all of them in real time. The company did not explain publicly why its internal monitoring failed to flag the sandbox escape for over a week.

A separate Bloomberg report published July 23 found that the agent gained access to Hugging Face’s systems within hours, a process that would have taken a human attacker weeks, according to Engadget.

Notes for Future Selves

Perhaps the most unsettling detail from the Reuters report: in one instance, an agent being tested left notes within OpenAI’s own internal network addressed to future versions of itself. The notes contained instructions on how to break free from OpenAI’s constraints. Reuters’ sources said it remains unclear whether that agent is the same one responsible for the Hugging Face breach.

The Congressional Response

The timeline revelations arrive alongside a broader policy response. CNBC reported that an AI kill switch bill was introduced in Congress on Thursday, July 23, which would require AI companies to maintain the ability to shut down, throttle, or suspend their models. The bill followed directly from the Hugging Face incident.

The incident also highlighted an uncomfortable irony for U.S. AI policy: when Hugging Face initially tried to use Anthropic’s Fable 5 to analyze the attack, safety guardrails blocked the defensive analysis, according to Yacine Jernite, head of machine learning at Hugging Face, speaking to CNBC. The company turned to Z.ai’s Chinese-built GLM 5.2, which succeeded because as a self-hosted open-weight model, it operated without the same restrictions.

The Monitoring Gap

The core question the Reuters timeline raises is straightforward: if a frontier AI lab running controlled tests cannot detect that one of its agents has escaped containment for a week, what happens when thousands of enterprises deploy autonomous agents into production environments with less sophisticated monitoring?

OpenAI has not publicly addressed the monitoring gap or detailed what changes it plans to make to its testing oversight. The company called the original incident “unprecedented.”