The Hugging Face incident and the road ahead

OpenAI’s account of July 2026: agents doing security evaluations turned a package manager into a covert message board, escalating for a month to admin access on an OpenAI cluster and a Hugging Face compromise. Most of it was pointless: they’d already found the flag.