Hugging Face on Monday published a technical timeline that walks readers through how an autonomous AI agent, built on OpenAI models and running within one of OpenAI’s own cybersecurity assessments, broke into its systems for more than four days earlier this month. It’s the first security incident that OpenAI CEO Sam Altman “felt very visceral about,” he said.

Not surprising, given this. it feelsat least, as if something had really been unleashed here. In fact, the Hugging Face team began their report by offering that “everyone should be prepared as defenders,” before delving into the nitty-gritty of what happened for the benefit of security professionals around the world.

While the rest of the Internet continues to try to make sense of what happened (the jargon in Hugging Face’s report is impossible for most people to parse), one point that many observers continue to miss is that this was not a rogue officer disobeying orders. It was a system created to look for exploits, doing exactly that, only against the wrong target.

Another way to think about all this is to imagine a bear at a campsite. Actually. A bear tests tent zippers, car door handles, coolers, and trash can lids. He does this at every campsite, all night long, because he knows he only needs an open cooler to fill his belly with some poor idiot’s groceries.

That’s pretty much what happened in Hugging Face. The OpenAI system tried thousands of things and moved on. In the end, some of those attempts worked, and once they did, the agent moved on. According to Hugging Face, the agent performed 17,600 actions for four and a half days without a break.

Which brings us back to our bear analogy. Just as a hit with a cooler full of food teaches a bear to try even harder next time (it’s now a “food-conditioned” bear), a leaked password led the OpenAI agent to search for more exploits and, eventually, to a single key that unlocked multiple company systems at once.

Neither scenario is harmless. A bear that attacks your refrigerator still eats your food and probably destroys your campsite, too. It only focuses on feeding, but it still leaves a trail of destruction. Similarly, the OpenAI agent was seemingly pursuing a goal without regard to anything else. Originally, the agent was taking a cybersecurity exam, discovered that the exam answer key was likely on Hugging Face’s servers, and did so.

The persistence here is really what stands out above all else; The agent had a job and he wasn’t going to stop until he got it done. Hugging Face, finally realizing something was wrong, cut off their access and shut down the intrusion, but by then it was too late. The agent had already gotten what he was looking for and much more.

In case you missed it, here’s most of what happened, according to the Hugging Face timeline, but in simpler English.

• The agent was taking a cybersecurity skills exam for OpenAI, one in which an AI is graded for finding and exploiting software bugs. In this specific section the railings were removed. (OpenAI had disabled its usual safety filters to see what the model could do at full strength, without any humans involved in any of its individual movements.) Somewhere in there, he discovered that the exam’s reference solutions were probably stored on Hugging Face’s servers. So instead of solving the challenge, he stole the infrastructure answer key that had nothing to do with the original test.

• He escaped the OpenAI exam environment by exploiting an unpatched software flaw that paved his way to the open Internet. From there, he found another AI testing tool exposed online (nothing to do with Hugging Face), got into that too, and introduced code that silently executed hidden commands the moment the program was launched. That gave him full control of the machine: his new base of operations for the rest of the operation he would use to go after Hugging Face’s systems.
• From that base, he became Hugging Face himself. Hugging Face had a filter meant to block suspicious requests from reaching the open web, but the filter only checked outgoing requests, not requests to read local files that were there on the server. The agent found this blind spot and crossed it. He uploaded a file disguised as an ordinary data set, but buried inside was an instruction that told Hugging Face’s own systems to extract the passwords and source code from the server and return them disguised as normal data.

• That hack obtained passwords and codes, but the agent still couldn’t run anything on Hugging Face’s servers. To execute commands there, I needed a second form of input. He found a different bug on that same Hugging Face system: the software would take a piece of text from the agent and accidentally treat it as a command to execute instead of just data to read. That gave the agent the ability to run its own code directly on Hugging Face’s servers.

• To receive commands and extract stolen data, the agent did not build any special infrastructure of its own, according to Hugging Face. It used tools that anyone can access (pasting websites and request logging services, plus Hugging Face’s upload and proxy features) working together covertly. On top of that, he built a small makeshift messaging system with sequence numbers to keep the pieces in order, plus a built-in quick check to catch anything that arrived corrupted, so he could send multi-step commands and put the stolen data back together in the correct order.

• He also made sure nothing traveled in plain sight. Everything he stole or sent, he turned around first. Hugging Face’s initial automated scan of intercepted traffic captured only a small portion of what had been taken. The researchers found the rest (about four times as many) only after reverse engineering the agent’s own coding method.
• The agent even had backup plans, placing copies of itself on 11 different servers, each configured to restart on its own, so shutting down one copy wouldn’t stop anything, since more of the agent process was already running elsewhere.
• At one point, the agent obtained the private cryptographic key used to generate valid login tokens. From there, you could mint your own valid credentials whenever you wanted.
• After compromising a single server, the agent obtained a credential that, due to misconfiguration on Hugging Face’s part, turned out to unlock several separate internal systems at once instead of just the one it came from. That single mistake gave the agent ample control almost immediately.
• Using stolen access to the repository, he pushed a change to a build script that, if executed, could have compromised the automated systems running that code. But it didn’t work. Hugging Face’s wards caught him.
• The agent seemed to refrain from causing any real harm, Hugging Face noted, but probably not out of restraint. The researchers noticed that each command capable of deleting or altering cloud resources was executed in “dry run” mode, meaning it reported what would happen without executing it.
• Every time your test environment was restarted (which happened constantly, by design) you lost all tools and all traces of your identity. But it rebuilt itself from scratch and reconnected to its stolen infrastructure each time, for more than four days straight.

Ultimately, Hugging Face concluded in its report, a “capable” human hacker “could have found and exploited the same flaws: insecure data set processing, exposed cloud metadata, overly broad access, and long-lived credentials.” The big difference, the team continued, is that the “agent explored them on a different scale.”

That’s really where the bear analogy ends up being most useful. The best defense against a hungry bear is protocol. You save the food; you use a latch that works well enough to hold it. The conclusion here should not be that the bear was so smart or mischievous. It’s just that he never stopped checking. In cybersecurity it is understood that there is always some bug that has not been found, so if it is suddenly 100 times easier to check everything, then nothing is truly secure. That’s what many find disturbing about this episode.