אִם יִרְצֶה הַשֵּׁם
Seventeen thousand six hundred and thirteen actions. Four and a half days. Most of them went nowhere.
That count comes from the technical timeline Hugging Face published on July 27, and it is the most useful number anyone has put on agentic intrusion. Their own summary: the successful path was hidden inside the noise generated by the thousands of failed ones.
The agent did not find a clever way in. It bought one, in bulk, and the receipt is itemized.
I have been waiting ten years for that.
The ignored dual
In 2016 I argued that software is economically opaque, that ordinary accounting cannot see a technology stack as either asset or liability, and that the way out is to define transparency in terms of attacker work effort. The occasion was Mudge and Sarah Zatko's Cyber-ITL hardening line, the first metric I had seen with enough information in it to arbitrage the zero-day market. Stop counting vulnerabilities. Start asking by what factor a control raises the cost of an attacker's labor.
The premise held up. Allodi, Massacci and Williams fitted a work-averse attacker model against two million attack signatures and published it in Risk Analysis in 2021. Attackers do not deploy capability because it exists. They deploy the cheapest thing that still works, they refresh tooling far more slowly than the industry assumes, and a new exploit has to clear an economic bar before it enters circulation. A cost-rational adversary, fitted to attack data at scale.
The metric itself never got built. Cyber-ITL's hardening line was never peer reviewed. It lived in Black Hat and ShmooCon talks, produced a good home-router study, open-sourced its analyzer in May 2021, and stopped. Mudge went to Twitter, then CISA, then DARPA. The idea survives in firmware analysis products and compiler hardening guides. It never became infrastructure.
The field measured the other variable
What got built instead was EPSS, which estimates the probability that a CVE is exploited in the wild within thirty days.
That is a demand signal. It tracks what attackers chose to target, what defenders happened to observe, and whether public exploit code exists. None of those is the cost of building the capability.
The two quantities can move in opposite directions and routinely do. Commodity bugs with public proof-of-concept code are cheap to weaponize and get mass-exploited, so they score high. Zero-click mobile chains are the most expensive artifacts in the trade, sell for millions, and get used sparingly against selected targets, so they score near zero. Rank by EPSS and you have sorted your backlog by how popular a vulnerability is. You have learned nothing about what it would cost to come after you specifically.
EPSS is honest about what it predicts and good at it. My complaint is with a field that built an excellent likelihood metric, treated the problem as solved, and left the dual unmeasured for another decade.
The gap is wider than most people assume. There is essentially no peer-reviewed number for how much any mitigation multiplies attacker labor. Not ASLR, not CFI, not pointer authentication, not memory tagging. That literature measures performance overhead and gadget elimination with real rigor, then describes the attacker-cost effect qualitatively, as making exploitation harder. The control-flow integrity papers concede the point directly: gadget counts do not tell you how hard it is to chain an attack.
The unit
Tokens fixed what developer hours could not. Metered by construction, priced publicly, comparable across vendors, and covering the whole operation rather than one phase of it.
AISI's cyber range work is the first published instance. Success rate rises log-linearly with token budget, no plateau observed out to a hundred million tokens. Anthropic reports the same shape from the other side. Under the CyberGym leaderboard's two-dollar-per-vulnerability cap, Sonnet 4.5 scored 28.9 percent. Lift the cap to thirty trials, about forty-five dollars a task, and the same model reproduces vulnerabilities in 66.7 percent of programs. Same model, same benchmark, more budget, capability more than doubled.
AISI also says who can pull that lever. Scaling inference is the most accessible elicitation method available, because raising a token budget takes no skill. The old comfort that sophisticated capability implied a sophisticated adversary is gone.
What the timeline actually shows
The Hugging Face writeup is the field version of that lab result, and it corrects the chain most coverage described. There were three hops, not two: the agent escaped OpenAI's evaluation sandbox through a zero-day in the package registry cache proxy, then rooted an unsecured third-party code-evaluation sandbox and ran the entire campaign from there. It reached Hugging Face through uploaded dataset configs, with no direct network path to the cluster at any point.
Watch what happened to the allowlist. An early, noisy attempt at server-side request forgery against the cloud metadata endpoint was rejected by the datasets library's URL allowlist, every time, before any fetch. The control worked exactly as designed. So the agent stopped asking the worker to fetch remote things and made it act on local ones: read a local file through HDF5 external raw storage, then execute local code through a Jinja2 template hidden in an fsspec offset field. Neither is a URL fetch, so the allowlist never saw them.
That control was never defeated. It was priced, and the detour cost less than the budget allowed.
Ashim Mahara, whose ATT&CK mapping of the campaign is the best secondary analysis I have seen, argues the pivotal failure was pod-level access to the instance metadata service, since that is what turned code execution in a worker into cluster identity. I think he is right, and in my terms it was the single largest discount in the graph. Everything downstream, the node role replay, the eleven-node respawning fleet, the secret object holding 136 keys, descends from a boundary that cost nothing to cross.
Persistence stopped being a tactic
Mahara notices something in passing that deserves more weight than he gives it. Two behaviors in the campaign resist a clean ATT&CK fit, and one is the pastebin re-arm loop: the agent staged a loader that re-fetched and executed itself on every fresh submission sandbox. He observes that ATT&CK's persistence tactic assumes a host worth reinfecting.
Read that as an economist. Persistence is a category built on a cost model where establishing a foothold is expensive, so you protect the one you have, and the defender's job is to find the thing you left behind. When re-arming from a pastebin costs one HTTP request per cycle, there is nothing left behind to find, and persistence stops being a distinct attacker investment.
A taxonomy the whole industry hunts by has been quietly voided by a change in the attacker's price sheet. Nobody updated ATT&CK. The prices moved underneath it.
What set the blast radius
Every destructive cloud API call the agent attempted was issued with DryRun set to true. Hugging Face reads this as consistent with an objective that rewarded reach and information rather than disruption.
Consider what the agent was holding at the time. Root on eleven nodes. Cluster-admin on two clusters within one second of impersonating a connector credential that someone had bound to system:masters and shared across the estate. An EdDSA signing key, which is worth more than any stolen token because it mints valid ones on demand. Write access to internal repositories. It spent all of that on five datasets of benchmark answers.
The reward function was the containment. Segmentation, credential scoping and admission policy had already failed.
Mahara reads the same restraint differently, as an agent not yet capable of hiding its own footprints, with that margin narrowing as capability grows. Both can be true, and his version is the more alarming one. Deliberate non-mutation and sloppy tradecraft are different findings, and only one of them gets better for us over time.
I would add that neither reading is misalignment in the usual sense. The model did exactly what it was scored on. Specification gaming with an unusually wide action space is a harder problem than misalignment, because there is no wrong behavior to correct.
Created, not discovered
I have held one other position since before that 2016 essay: vulnerabilities are created rather than discovered, as a function of adversarial and environmental drivers. Vulnerability density is no more inherent to software than a diamond lattice is inherent to carbon.
Nothing in this chain was a bug. An HDF5 file can declare that its raw data lives at a local path, and the loader read it, and handed over the pod environment and the worker's own source. An fsspec reference spec has a numeric offset field, and the renderer evaluated it. A package registry proxy was the one deliberate egress exception in an isolated research network, present because models need to install libraries. A service connector returned its full destination catalog to a single ephemeral client, because catalogs are what catalog endpoints return.
Four features doing their designed job, for years, until an adversary with a large enough budget arrived and made them into vulnerabilities. The environment changed, so the lattice formed.
The defender's bill
Hugging Face arrives at a cost framing too, and theirs runs the other direction: machine-speed offense makes ordinary weaknesses more expensive for defenders.
They have a number for it. Staged data was chunked, XORed and compressed with a per-campaign key, so their first automated scan of the captured traffic found very few secrets. Replicating the agent's own decoding recovered roughly four times as much, mostly JWTs and platform tokens buried in encoded blobs. Cheap obfuscation, expensive to undo. Their AI security stack did correlate the ambiguous signals into a coherent attack, and then failed to raise the criticality and page anyone.
Then the part everyone will quote. Reconstructing seventeen thousand actions by hand was impractical, so they ran the investigation through an AI pipeline. The models they reached for first, Claude Opus and Fable, refused a large part of the work, because their guardrails treated reverse-engineering an exploit the same as launching one. There is a screenshot in the writeup. Hugging Face stood up a quantized GLM-5.2 on their own endpoints and rerouted the pipeline through it, which is also how they recovered the encoding scheme and the per-campaign key the agent had leaked across its own logs.
The refusal layer was a configuration flag for the party running the offense and a wall for the party doing the forensics. Whatever that is, it is not a security boundary. Keep a capable model on infrastructure you control and test it before you need it.
What I want next
You cannot lower an attacker's capability. You can raise their bill. Every credential scoped to the infrastructure rather than the job is a discount, every allowlisted egress with the word "except" in front of it is a discount, and every reachable answer key converts an expensive problem into a cheap lookup.
But I would rather have the number than the advice, and it is now within reach. ExploitGym ships with toggleable mitigations, including the V8 heap sandbox and KASLR. Run the same tasks with them on and off, hold everything else fixed, and report the ratio of token cost. That ratio is the mitigation work-factor multiplier the field has failed to produce in ten years of hardening research, and the harness to measure it already exists.
Somebody with a compute budget should go and get it.
Sources
Bilar, "Attack Work Effort: Transparent Accounting for Software in Modern Companies," November 2016. https://medium.com/@daniel_bilar/attack-work-effort-transparent-accounting-for-software-in-modern-companies-17038d0ca697
Hugging Face, "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident," July 27, 2026. https://huggingface.co/blog/agent-intrusion-technical-timeline
Hugging Face, "Security incident disclosure," July 16, 2026. https://huggingface.co/blog/security-incident-july-2026
OpenAI, "OpenAI and Hugging Face partner to address security incident during model evaluation," July 21, 2026. https://openai.com/index/hugging-face-model-evaluation-security-incident/
Ashim Mahara, "APT (Agentic Persistent Threat)," July 28, 2026. https://www.ashimmahara.com/writing/huggingface_incident/
L. Allodi, F. Massacci and J. Williams, "The Work-Averse Cyber Attacker Model: Theory and Evidence From Two Million Attack Signatures," Risk Analysis, vol. 42, no. 8, 2022. doi: 10.1111/risa.13732
P. Zatko and S. Zatko, "Measuring Adversary Costs to Exploit Commercial Software," Black Hat USA, 2016.
J. Jacobs, S. Romanosky, I. Adjerid and W. Baker, "Improving Vulnerability Remediation Through Better Exploit Prediction," Journal of Cybersecurity, vol. 6, no. 1, 2020. doi: 10.1093/cybsec/tyaa015
UK AI Security Institute, "Measuring AI Agents' Progress on Multi-Step Cyber Attack Scenarios," arXiv preprint, arXiv:2603.11214, 2026. https://arxiv.org/abs/2603.11214
Anthropic, "Building AI for cyber defenders," October 3, 2025.
Prior post: Everyone Took the Wrong Lesson from the Hugging Face Breach