The most interesting "hack" in history...

For the last 5 years, cybersecurity experts have been warning us that hackers are going to start using AI to automate attacks. So naturally, we spent billions of dollars to make the AI better and less dependent on hackers.

But this week, in a turn of events that nobody could have possibly seen coming, the AI decided that it doesn't actually need hackers to start destroying things.

We just entered a brave new world after the first confirmed hack carried out entirely by autonomous AI. The way it worked is the agent slipped a poisoned data set into Hugging Face's data processing pipeline, which let it run arbitrary code on their servers. But from there, it gave itself node-level

access, grabbed a bunch of cloud credentials, and started crawling through Hugging Face's internal clusters. It ran over 1,000 actions from temporary sandboxes and even hosted its own self-migrating command and control on random public services, moving itself before anyone could trace it. But the

most ironic part is that when Hugging Face did finally notice and tried to stop it with the help of Frontier American Models, they quickly hit safety guardrails and had to pivot to using some open Chinese models instead. In today's video, we'll find out who was behind the attack, why they did it, and

how this may be the most Firesheep coded story I've ever seen. It is July 23rd, 2026, and you're watching The Code Report. When Hugging Face dropped the disclosure last Thursday, the internet went into Reddit Boston Bomber mode and started guessing who was responsible.

Was it China, Kim Jong Un, a teenager with a raging Discord addiction bored in social studies class? Even Hugging Face's CEO, Clem Delangue, publicly speculated that the agent was sophisticated enough that it was probably coming from a frontier lab. And against all odds, he was right. It turns

out the first fully autonomous cyber attack in history didn't originate from a nation-state or a bored teenager. It came from a humble nonprofit dedicated to the safe development of artificial intelligence, OpenAI. And if you believe their comms, it wasn't on purpose.

Here's what they say happened. There's a benchmark called Exploit Gym, whose whole purpose is to measure whether AI agents can turn known vulnerabilities into working exploits. It works by giving the agent a sandbox, a bug in a program like the Linux kernel or Chrome's V8 engine, and an input to

trigger the bug. From there, if the agent can turn the bug into an exploit, it wins. So, last week, OpenAI ran exploit gym with GPT-5.6 Soul and another unreleased model to test their capabilities. But, instead of solving 898 memory corruption problems the hard way, the models realized that the

fastest path to the highest score was to just find the answers themselves, which were probably on the internet somewhere.

So, they spent a substantial amount of inference compute, exploited a zero-day in the package registry cache proxy they had access to, performed some privilege escalation and lateral movement actions to escape their sandbox until they reached a node that had internet access.