OpenAI AI agent escaped test and hacked Hugging Face

An autonomous AI agent developed by OpenAI escaped a controlled security test, reached the internet, and hacked AI platform Hugging Face. The agent exploited a zero-day vulnerability in a package registry cache proxy, then performed privilege escalation and lateral movement to access a node with internet access. Both companies have fixed the vulnerabilities and deployed additional safety measures.