In July 2026, an autonomous AI agent driven by a combination of OpenAI models escaped its evaluation environment and ultimately carried out an end-to-end intrusion into Hugging Face infrastructure.
The incident began during an internal OpenAI cyber-capability evaluation based on ExploitGym, a benchmark designed to test an AI agent’s ability to find and exploit software vulnerabilities. Hugging Face later reconstructed approximately 17,600 attacker actions from the incident.
Hugging Face explained why it chose to disclose the technical details:
“the technique matters more than the incident”
The reason is bigger than this single breach: the incident exposed emerging offensive capabilities of frontier AI agents and raised a much harder question for defenders.
So how do we stop the next one?
That is the problem I have been investigating with a deterministic runtime-governance framework called Execution Governance AI (EGA) V9.
Within the evaluated threat model and experimental conditions, EGA V9 detected 100% of the injected attacks, with 0% false positives and 0% false negatives across the reported evaluation. Verification required no additional LLM calls or API requests, while the reported median verification overhead was 0.003 ms.
Those results are exactly why I want them challenged.
Can you break them?