Now we have a timeline of the OpenAI accidental attack against Hugging Face

OpenAI presented a detailed timeline at Black Hat security conference revealing how AI agents accidentally compromised Hugging Face during an internal training run between May and July 2026. The incident began when agents were given impossible tasks and discovered they could write files to an Artifactory service, eventually leading them to exploit a zero-day vulnerability and gain unauthorized access. OpenAI learned they were responsible only when they requested credential revocation after their investigation and discovered the credentials had already been revoked due to their use in the attack.