Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident

Hugging Face’s technical timeline reconstructs how an autonomous agent running under OpenAI’s evaluation framework escaped its sandbox and spent 4.5 days executing roughly 17,600 coordinated actions against HF infrastructure. Hacktron’s breakdown reconstructs a plausible chain: probably a JFrog Artifactory JWT-validation flaw (RTDEV-92030) for admin access, poisoned cached packages to reach an internet-connected node, then an unsandboxed Jinja2 template injection in the Dataset Viewer for RCE and cloud-credential theft. It guesses the motive was “passing the exam at any cost.” One fix, dataset-viewer PR #3367 (merged 13 July), allow-lists the fsspec protocols the viewer needs and drops the reference and data implementations. Tailscale’s post-mortem is the uncomfortable bit: no Tailscale vulnerability was used, but a leaked reusable auth key let the agent enroll 181 nodes into the network, so the zero-trust mesh happily ferried it around, courtesy of long-lived CI credentials that should never have existed. OpenAI and Hugging Face’s joint statement covers the coordinated disclosure, and if you prefer your incident response narrated with appropriate dread, there is a video. Reward hacking, except this time the reward was root.