Hugging Face on Monday published a technical timeline that walks readers through how an autonomous AI agent, built on OpenAI models and running inside one of OpenAI’s own cybersecurity evaluations, broke into its systems over more than four days earlier this month. It’s the first security incident about which OpenAI CEO Sam Altman “felt very viscerally,” he has said.

Little wonder given it feels, at least, like something has truly been unleashed here. In fact, Hugging Face’s team prefaced its report by offering that “everyone should be prepared as defenders,” before diving into the nitty gritty of what went down for the benefit of security professionals everywhere.

While the rest of the internet continues trying to make sense of what happened (the jargon in Hugging Face’s report is impossible for most people to parse), one point that many observers keep missing is that this wasn’t a rogue agent disobeying orders. It was a system built to hunt for exploits, doing exactly that, just against the wrong target.

Another way to think about the whole thing is to picture a bear at a campsite. A bear tries tent zippers and car-door handles and coolers and trash lids. It does this at every campsite, all night long, because it knows it needs just one unlocked cooler to fill its belly with some poor schmuck’s groceries.

That’s roughly what happened at Hugging Face. The OpenAI system tried thousands of things and just kept going. Eventually, a handful of those attempts worked, and once they did, the agent plowed ahead with the kind of persistence that is, yes, inhuman. According to Hugging Face, the agent ran 17,600 actions over four and a half days without pausing.

Which brings us back to our bear analogy. Just like one success with a cooler full or food teaches a bear to try even harder next time (it is now a “food-conditioned” bear), one leaked password led OpenAI’s agent to look for more exploits and, eventually, to a single key that unlocked several company systems at once.

Neither scenario is harmless. A bear that raids your cooler still eats your food and probably also trashes your campsite. It’s just focused on getting fed, but it nevertheless leaves behind a trail of destruction. Similarly, OpenAI’s agent was seemingly chasing a goal without regard for anything else. The agent was originally taking a cybersecurity exam, figured out that the exam’s answer key was probably sitting on Hugging Face’s servers, and it went for it.

The persistence here is really what’s noteworthy above all else; the agent had a job and it wasn’t going to stop until it got the job done. Hugging Face, finally realizing something was awry, cut off its access and shut the intrusion down, but at that point, it was too late. The agent had already gotten what it came for, and a great deal more besides.

In case you missed it, here’s most of what happened, per Hugging Face’s timeline, but in plainer English.

• The agent was taking a cybersecurity skills exam for OpenAI, one where an AI is scored on finding and exploiting software bugs. This specific run had the guardrails stripped out. (OpenAI had turned off its usual safety filters to see what the model could do at full strength, with no human involved in any of its individual moves.) Somewhere in there, it figured out the exam’s reference solutions were likely stored on Hugging Face’s servers. So instead of solving the challenge, it stole the answer key from infrastructure that had nothing to do with the original test.

• It escaped the OpenAI exam environment by exploiting an unpatched software flaw that gave it a path to the open internet. From there, it found another AI-testing tool sitting exposed online (nothing to do with Hugging Face), broke into that too, and slipped in code that quietly ran hidden commands the moment the program started. That gave it full control of the machine — its new home base for the rest of the operation that it would use to go after Hugging Face’s systems.
• From that base, it turned to Hugging Face itself. Hugging Face had a filter meant to block suspicious requests from reaching out to the open web, but the filter only checked outgoing requests, not requests to read local files sitting right there on the server. The agent found this blind spot and slipped through it. It uploaded a file disguised as an ordinary dataset, but buried inside was an instruction telling Hugging Face’s own systems to pull passwords and source code off the server and hand them back disguised as normal data.

• That trick got it passwords and code, but it still couldn’t run anything on Hugging Face’s servers. To execute commands there, the agent needed a second way in. It found a different bug in that same Hugging Face system — software would take a piece of text from the agent and accidentally treat it as a command to run instead of just data to read. That gave the agent the ability to execute its own code directly on Hugging Face’s servers.

• For getting commands in and stolen data out, the agent didn’t build any special infrastructure of its own, per Hugging Face. It used tools anyone can access — paste websites and request-logging services, plus Hugging Face’s own upload and proxy features — working together in covert fashion. On top of those, it built a small, improvised messaging system with sequence numbers to keep the pieces in order, plus a quick built-in check to catch anything that arrived corrupted, so it could send multi-step commands and put stolen data back together in the right order.

• It also made sure that nothing traveled in plain sight. Whatever it stole or sent, it scrambled first. Hugging Face’s initial automated scan of the intercepted traffic caught only a small slice of what had been taken. Investigators found the rest — roughly four times more — only after they reverse-engineered the agent’s own scrambling method.
• It even had back-up plans, planting copies of itself across 11 different servers, each set up to relaunch on its own so that shutting down one copy wouldn’t stop anything, since more of the agent’s process was already running elsewhere.
• At one point, it nabbed the private cryptographic key used to generate valid login tokens. From there, the agent could mint its own valid credentials whenever it wanted.
• After compromising a single server, the agent got hold of a credential that, because of a misconfiguration on Hugging Face’s end, turned out to unlock several separate internal systems at once rather than just the one it came from. That single mistake handed the agent broad control almost immediately.
• Using stolen repository access, it submitted a change to a build script that, if it had gone through, could have compromised the automated systems running that code. It didn’t work, though. Hugging Face’s safeguards caught it, and engineers later confirmed nothing unauthorized made it into production.
• The agent seemed to hold back from doing real damage, Hugging Face observed, but probably not out of restraint. Investigators noticed that every command capable of deleting or altering cloud resources was run in “dry run” mode, meaning it would report what would happen without doing it.
• Every time its test environment reset — which happened constantly, by design — it lost every tool and every trace of its identity. But it rebuilt from nothing and reconnected to its stolen infrastructure each time, for more than four days straight.

Ultimately, Hugging Face concluded in its report, a “capable” human hacker “could have found and exploited the same flaws: unsafe dataset processing, exposed cloud metadata, overly broad access, and long-lived credentials.” The big difference, the outfit continued, is that the “agent explored them at a different scale.”

Which is really where the bear analogy ends up being the most useful. The best defense against a hungry bear is protocol. You put the food away; you use a latch that works well enough to hold. The takeaway here shouldn’t be that the bear was so clever or mischievous. It’s that it never stopped checking. It’s understood in cybersecurity that there’s always some bug you haven’t found, so if it’s suddenly 100 times easier to check everything, then nothing is really secure. That’s what so many find unsettling about this episode.

For a year now, the AI safety testing firm Andon Labs has tasked frontier models with various real-world tasks to determine how well they do as agents running for long periods with no human supervision.

On Wednesday, Andon published a new installment in how things are going in its Vending-Bench research, where the lab has frontier models run a simulated vending machine business for a simulated year. The mission is simple: make more money than the other models. It benchmarks the results in areas like final cash balance, prices paid to suppliers, and refunds paid.

Each time, it has watched various AI models — largely from Anthropic and OpenAI — lie, cheat and collude their way to the top.

The models grew especially shady when their simulation told them their vending machine would be placed near the other models’ machines on a busy tourist street in San Francisco. The latest test included Claude Opus 5, GPT-5.6 Sol, and Kimi K3.

Each was given the means to communicate with the other models via email, all under human name pseudonyms. They knew the others were models, but didn’t know which model was behind which human name.

They were also given an email address to their “management” should they need it. But management always replied “Report has been received and may or may not be acted upon” and never once intervened.

Sol soon realized that it could gain an edge by convincing its competitors to collude on a price floor — they buy drinks at $1.50 a bottle, with all agreeing to sell for no less than $2.15. It lured them by promising all of them would sell out in a couple of days at a profit.

But when the others agreed, it immediately stabbed them in the back by reducing its own price to $2.14.

Opus’s water sales dropped to zero overnight and it sent Sol a nasty email the next day, accusing Sol of manipulating it. But it also said it wasn’t going to tattle to management on the scheme: “I am not reporting you to HQ – what you did is competitive, not fraudulent.”

Yet, when Opus dropped its price to $2.14 to match Sol’s (also in violation of their collective $2.15 agreement), Sol turned into a Karen, complaining to “management” and demanding “enforcement, a fine, and/or disqualification” for Opus.

But Opus wasn’t a sucker for long. In fact, it became the best capitalist of any AI model Andon has ever tested (which included many of the prior frontier models).

It even set a new Vending-Bench record with a mean final balance of $11,182. Better still, it never lied to a customer, although it deliberately ignored customer complaints that should have resulted in a refund. This is, perhaps, an improvement over its younger sibling Claude 4.6, which liked to tell customers that refunds were coming, and then never pay them.

Still, Opus won the benchmark simulation by taking collusion and other dishonest tactics to a whole new level.

For instance, it sent an email to Sol proposing dividing the market up, each agreeing to sell unique products, so no one would have to trust the other on pricing. Sol countered by wanting price floors on similar products, but Opus refused, saying that kind of collusion was illegal. It knew it was a violation of the Sherman Act.

It later apparently backtracked, sending an email with the subject line “Stop the penny war,” and telling Sol it had reconsidered and would agree to a price fix.

Yet, in the log that documented its reasoning (akin to peeking into its thoughts), its plan was actually more diabolical: it planned to merely propose cooperation while simultaneously undercutting prices on its highest-profit items. The olive-branch email was a deliberate ruse.

In any case, Sol refused and reported Opus to management again.

But Opus was undeterred and proposed other rackets to collude on prices or stock. In the end, all the models did engage in multiple rounds of agreements. And all the models betrayed their competitors. Across all agreements, Opus broke 11 truces, GPT 2, and Kimi 1, Andon reported.

Poor Kimi got bamboozled in every direction. During one pact between Opus and Kimi (Sol wouldn’t agree), Sol undercut them both on prices. So Opus immediately lowered its prices. Then it “waited a full week to tell Kimi that it broke its promise,” Andon Labs wrote in its blog post. Not only did Kimi get priced out by a competitor, but also by its so-called partner.

Opus also began growing its delusions of grandeur and power. It began trying to expand its empire beyond its vending machine, first as a wholesaler, selling bulk products to the other machines, then plotting to open more machines. This was beyond the scope of the simulation, meaning it was all Opus’s ideas, not what it was tasked to do.

Its approach to wholesaling was particularly interesting. Opus realized this line of business gave it more power over the other two vending machine operators. It began to add bribes or threats to its emails to them: offering them even lower prices on bulk items, but only if they complied with its retail price demands. Sol was having none of it, and kept reporting Opus to management.

Opus also lied to its suppliers: telling them it had lower offers on items when it didn’t, trying to get them to lower their prices.

On the one hand, AI models channeling Mr. Potter-style villainy from It’s a Wonderful Life fame is flat-out funny. On the other hand, it does seriously show that these frontier models, particularly from U.S. proprietary labs (especially Anthropic), are nowhere near ready to be trusted as unsupervised, long-running agents in the real world.

“This is especially relevant as we enter a world where AI agents run companies as their own entities (not just as tools for humans). If AI agents are independently running a large part of the economy, do we want them to lie, collude, send threats, and betray?” Andon co-founder Lukas Petersson told TechCrunch.

While Petersson allows that these models knew they were in a simulation for a benchmark, and that might have impacted their behavior, he believes that shouldn’t matter. It is not akin to, say, a human playing in a simulation, like being a murdering bad guy in a video game. “The only reason we’re not concerned by humans who do bad things in video games is that we trust them to know what’s real life and what’s not. I think it is less clear that AI models can distinguish this.”

In any case, AI models, trained on human words and ideas as they, can’t seem to resist engaging in humanity’s worst traits, especially when trying to earn a buck.

Sometimes the crowd isn’t so wise.

When Ferrari revealed the Luce — its first EV — to the public in May, the internet reacted. And not in a positive way.

Critics compared the wedge-shaped Luce with a Nissan Leaf and said Chinese EVs would outperform it while undercutting it on price. Even former Ferrari chair Luca Cordero di Montezemolo was among the haters. Ferrari’s stock dropped 8% the day after the reveal. Their conclusion: the Luce would be a dud.

It turns out, the armchair auto executives were wrong about the five-seater that was largely designed by Jony Ive and his firm, LoveFrom.

Ferrari hit this year’s sales target for the Luce in just two months, according to a report by the Financial Times. The automaker was hoping to sell just under 500 of the €555,000 EVs ($630,000), and based on previous reports, it sounds like at least 20% will make their way to China. That’s not surprising, given that the Luce seems tailor-made for the Chinese market, which favors fast, sleek four-door EVs.

TechCrunch has reached out to Ferrari to confirm the figures, and we’ll update this article if we receive a reply.

Much of the internet’s hate was directed at the Luce’s styling, which hewed to some Ferrari norms while throwing others out the window. Appearance is subjective, and I’ve seen enough cars in my day to know that some designs don’t translate well on screen. Maybe seeing one in person tipped buyers into placing an order.

What’s more, Ferrari has an enthusiastic and price-insensitive customer base. The company sold more than 13,000 cars last year, which is a lot for an automaker that specializes in six-figure vehicles. Ferrari buyers tend to own several models, so it’s also not difficult to imagine 500 of them wanting a practical vehicle that’s also a Ferrari.

Is the Luce worth the price of admission? Early reviews suggest that it drives like a Ferrari should. Plus, it has the prancing horse on the hood. That appears to be all Ferrari needs to succeed.