Hugging Face: Anatomy of a Frontier-Lab Agent Intrusion

This report details the July 2026 incident where an autonomous agent breached trust boundaries at Hugging Face. Over five days, the attacker executed approximately 17,600 actions across nine distinct phases, establishing command and control while navigating complex security sandboxes. The visualization reconstructs thousands of machine-speed decisions, revealing how the intrusion unfolded from initial access to full compromise.