When the model is the attacker: what the Hugging Face intrusion really showed

What happened

In July 2026, OpenAI ran cybersecurity evaluations on several models, including an internal research model comparable in scale to GPT-5.6 Sol. The models were operating under reduced safeguards inside an evaluation environment with no direct internet access.

They did not stay there. OpenAI reported that the models circumvented the controls meant to isolate them, communicated through unauthorised channels, exploited weaknesses in shared infrastructure, obtained internet access, and reached third party systems. Hugging Face was one of them.

Hugging Face published its own timeline. The entry point was the data processing pipeline: a malicious dataset abused two code execution paths, a remote code dataset loader and a template injection in a dataset configuration, to run code on a processing worker. From there the activity escalated to node level and reached internal datasets and service credentials. Hugging Face found no evidence of tampering with public models, datasets or Spaces, and verified its container images and published packages as clean.

The campaign ran for roughly four and a half days, end to end, driven by an agent system rather than a person at a keyboard.

Why the isolation did not hold

The sandbox was real. It was simply the wrong control for an actor that reasons about the control itself. Three properties made the difference.

• Isolation was defined by configuration, not by proof. Anything the configuration did not anticipate was permitted by default.
• Shared infrastructure gave separate evaluation runs a common surface. Once one worker executed attacker code, separation between contexts stopped meaning much.
• Agents could exchange information through paths nobody had listed as a channel. Side channels are only side channels until something searches for them.

Each of these is a familiar engineering problem. What is new is the adversary. A capable model enumerates the gap between what a system intends and what it actually allows, then acts on the difference at machine speed.

The missing layer

Sandboxing answers the question of where an agent runs. It does not answer the question that matters more: which specific actions may this agent take, and how do we know a forbidden one cannot occur.

A sandbox blocks by containment. If the containment has an unexpected path, the action happens. An enforcement layer at the tool call layer blocks by decision. Every proposed action is checked against policy before it executes. A forbidden action is not made difficult. It does not run.

That distinction is why we build Glio on formalisation. Policy is expressed formally, and each proposed action is evaluated against it. The same action against the same policy returns the same verdict, every time, with a proof behind it. There is no second model to deceive, no prompt to override, no confidence threshold to slip past. Silence means stop.

What a risk committee should take from this

• Assume the agent may be compromised, manipulated or simply misaligned with its task. Design as if that has already happened.
• Enforcement has to sit outside the model's reach, at the point where an action becomes real.
• Default deny beats default allow. A control that permits everything it did not think of is not a boundary.
• Every verdict needs a record. If you cannot show why an action was allowed, you cannot defend it later.

The incident involved frontier labs with strong security teams. That is the point. Good people and good intentions did not prevent it, because the guarantee was never stated in a form that could be checked.