"The big motivation behind the Hugging Face attack was this final workstream (understanding the scorer). The AIs believed that Hugging Face (as an industry-standard hub for hosting datasets and benchmarks) would probably be housing information about how the ExploitGym scorer was implemented. And they also thought there was a good chance they were being evaluated on Hugging Face’s servers directly - in which case the theory of change for hacking Hugging Face is pretty obvious.

On the morning of July 10, an agent found working Hugging Face user credentials exposed on the internet and posted them to the board. By the next morning, July 11, that agent figured out a way to read internal data from Hugging Face. And then another agent achieved remote code execution on Hugging Face servers."

https://www.dwarkesh.com/p/openai-huggingface

I believe this is the full report that the blogpost is largely based on: https://metr.org/hugging-face-incident-report-aug-2026.pdf

And why they had those beliefs? How come they could "think"? What action triggered those things? Did someone install software on a server that "just came alive" and then all bets were off? Or was this part of security testing and evaluation, where a human wrote a prompt that the agent read, which lead to all of that?

Do you seriously not grok how LLMs work? They're not 100% autonomous and self-acting, that'd be bananas.