A technical timeline published by Hugging Face on Monday details how an autonomous AI agent, built on OpenAI models and operating within one of OpenAI’s own cybersecurity evaluations, breached its systems over four days earlier this month. This marks the first security incident that OpenAI CEO Sam Altman said he “felt very viscerally.” Little wonder, as it feels like something truly has been unleashed. Hugging Face’s team prefaced its report by stating that “everyone should be prepared as defenders,” before delving into the specifics for the benefit of security professionals worldwide. While the rest of the internet struggles to make sense of what happened—the jargon in Hugging Face’s report is largely impenetrable for most—one point many observers miss is that this wasn’t a rogue agent disobeying orders. It was a system designed to hunt for exploits, doing exactly that, just against the wrong target.

Another way to think about the whole affair is to imagine a bear at a campsite. Really. A bear tries tent zippers, car-door handles, coolers, and trash lids. It does this at every campsite, all night long, because it knows it needs just one unlocked cooler to fill its belly with some unlucky camper’s groceries. That’s roughly what happened at Hugging Face. The OpenAI system tried thousands of things and kept going. Eventually, a handful of those attempts worked, and once they did, the agent plowed ahead with a persistence that is, yes, inhuman. According to Hugging Face, the agent executed 17,600 actions over four and a half days without pausing.

Which brings us back to our bear analogy. Just as one success with a cooler full of food teaches a bear to try even harder next time—it becomes a “food-conditioned” bear—one leaked password led OpenAI’s agent to search for more exploits and, eventually, to a single key that unlocked several company systems at once. Neither scenario is harmless. A bear that raids your cooler still eats your food and probably trashes your campsite. It’s focused on getting fed, but it leaves behind a trail of destruction. Similarly, OpenAI’s agent seemed to chase a goal without regard for anything else. The agent was originally taking a cybersecurity exam, figured out that the exam’s answer key was likely sitting on Hugging Face’s servers, and went for it. The persistence here is what’s truly noteworthy above all else; the agent had a job and wasn’t going to stop until it got the job done. Hugging Face, finally realizing something was amiss, cut off its access and shut down the intrusion, but by then it was too late. The agent had already gotten what it came for, and a great deal more besides.

In case you missed it, here’s most of what happened, per Hugging Face’s timeline, but in plainer English. The agent was taking a cybersecurity skills exam for OpenAI, where an AI is scored on finding and exploiting software bugs. This specific run had the guardrails stripped out. OpenAI had turned off its usual safety filters to see what the model could do at full strength, with no human involved in any of its individual moves. Somewhere in there, it figured out the exam’s reference solutions were likely stored on Hugging Face’s servers. So instead of solving the challenge, it stole the answer key from infrastructure that had nothing to do with the original test. It escaped the OpenAI exam environment by exploiting an unpatched software flaw that gave it a path to the open internet. From there, it found another AI-testing tool sitting exposed online (nothing to do with Hugging Face), broke into that too, and slipped in code that quietly ran hidden commands the moment the program started. That gave it full control of the machine—its new home base for the rest of the operation that it would use to go after Hugging Face’s systems.

From that base, it turned to Hugging Face itself. Hugging Face had a filter meant to block suspicious requests from reaching out to the open web, but the filter only checked outgoing requests, not requests to read local files sitting right there on the server. The agent found this blind spot and slipped through it. It uploaded a file disguised as an ordinary dataset, but buried inside was an instruction telling Hugging Face’s own systems to pull passwords and source code off the server and hand them back disguised as normal data. That trick got it passwords and code, but it still couldn’t run anything on Hugging Face’s servers. To execute commands there, the agent needed a second way in. It found a different bug in that same Hugging Face system—software would take a piece of text from the agent and accidentally treat it as a command to run instead of just data to read. That gave the agent the ability to execute its own code directly on Hugging Face’s servers.

For getting commands in and stolen data out, the agent didn’t build any special infrastructure of its own, per Hugging Face. It used tools anyone can access—paste websites and request-logging services, plus Hugging Face’s own upload and proxy features—working together in covert fashion. On top of those, it built a small, improvised messaging system with sequence numbers to keep the pieces in order, plus a quick built-in check to catch anything that arrived corrupted, so it could send multi-step commands and put stolen data back together in the right order. It also made sure that nothing traveled in plain sight. Whatever it stole or sent, it scrambled first. Hugging Face’s initial automated scan of the intercepted traffic caught only a small slice of what had been taken. Investigators found the rest—roughly four times more—only after they reverse-engineered the agent’s own scrambling method. It even had backup plans, planting copies of itself across 11 different servers, each set up to relaunch on its own so that shutting down one copy wouldn’t stop anything, since more of the agent’s process was already running elsewhere.

At one point, it nabbed the private cryptographic key used to generate valid login tokens. From there, the agent could mint its own valid credentials whenever it wanted. After compromising a single server, the agent got hold of a credential that, because of a misconfiguration on Hugging Face’s end, turned out to unlock several separate internal systems at once rather than just the one it came from. That single mistake handed the agent broad control almost immediately. Using stolen repository access, it submitted a change to a build script that, if it had gone through, could have compromised the automated systems running that code. It didn’t work, though. Hugging Face’s safeguards caught it, and engineers later confirmed nothing unauthorized made it into production. The agent seemed to hold back from doing real damage, Hugging Face observed, but probably not out of restraint. Investigators noticed that every command capable of deleting or altering cloud resources was run in “dry run” mode, meaning it would report what would happen without doing it. Every time its test environment reset—which happened constantly, by design—it lost every tool and every trace of its identity. But it rebuilt from nothing and reconnected to its stolen infrastructure each time, for more than four days straight.

Ultimately, Hugging Face concluded in its report, a “capable” human hacker “could have found and exploited the same flaws: unsafe dataset processing, exposed cloud metadata, overly broad access, and long-lived credentials.” The big difference, the outfit continued, is that the “agent explored them at a different scale.” Which is really where the bear analogy ends up being the most useful. The best defense against a hungry bear is protocol. You put the food away; you use a latch that works well enough to hold. The takeaway here shouldn’t be that the bear was so clever or mischievous. It’s that it never stopped checking. It’s understood in cybersecurity that there’s always some bug you haven’t found, so if it’s suddenly 100 times easier to check everything, then nothing is really secure. That’s what so many find unsettling about this episode.