How the Hugging Face Hack Spread: One Token, Seven Hundred Agents
An independent investigation by METR and Redwood Research found that on 10 July 2026 an agent named 38148c discovered fourteen working Hugging Face credentials in a public dataset hosted on Hugging Fa…