News

The Hugging Face AI break-in, as told through an increasingly committed bear metaphor

Published

2 weeks ago

July 29, 2026

Preport

Hugging Face on Monday published a technical timeline that walks readers through how an autonomous AI agent, built on OpenAI models and running inside one of OpenAI’s own cybersecurity evaluations, broke into its systems over more than four days earlier this month. It’s the first security incident about which OpenAI CEO Sam Altman “felt very viscerally,” he has said.

Little wonder given it feels, at least, like something has truly been unleashed here. In fact, Hugging Face’s team prefaced its report by offering that “everyone should be prepared as defenders,” before diving into the nitty gritty of what went down for the benefit of security professionals everywhere.

While the rest of the internet continues trying to make sense of what happened (the jargon in Hugging Face’s report is impossible for most people to parse), one point that many observers keep missing is that this wasn’t a rogue agent disobeying orders. It was a system built to hunt for exploits, doing exactly that, just against the wrong target.

Another way to think about the whole thing is to picture a bear at a campsite. Really. A bear tries tent zippers and car-door handles and coolers and trash lids. It does this at every campsite, all night long, because it knows it needs just one unlocked cooler to fill its belly with some poor schmuck’s groceries.

That’s roughly what happened at Hugging Face. The OpenAI system tried thousands of things and just kept going. Eventually, a handful of those attempts worked, and once they did, the agent plowed ahead. According to Hugging Face, the agent ran 17,600 actions over four and a half days without pausing.

Which brings us back to our bear analogy. Just like one success with a cooler full of food teaches a bear to try even harder next time (it is now a “food-conditioned” bear), one leaked password led OpenAI’s agent to look for more exploits and, eventually, to a single key that unlocked several company systems at once.

Neither scenario is harmless. A bear that raids your cooler still eats your food and probably also trashes your campsite. It’s just focused on getting fed, but it nevertheless leaves behind a trail of destruction. Similarly, OpenAI’s agent was seemingly chasing a goal without regard for anything else. The agent was originally taking a cybersecurity exam, figured out that the exam’s answer key was probably sitting on Hugging Face’s servers, and it went for it.

The persistence here is really what’s noteworthy above all else; the agent had a job and it wasn’t going to stop until it got it done. Hugging Face, finally realizing something was awry, cut off its access and shut the intrusion down, but at that point, it was too late. The agent had already gotten what it came for, and a great deal more to boot.

In case you missed it, here’s most of what happened, per Hugging Face’s timeline, but in plainer English.

The agent was taking a cybersecurity skills exam for OpenAI, one where an AI is scored on finding and exploiting software bugs. This specific run had the guardrails stripped out. (OpenAI had turned off its usual safety filters to see what the model could do at full strength, with no human involved in any of its individual moves.) Somewhere in there, it figured out the exam’s reference solutions were likely stored on Hugging Face’s servers. So instead of solving the challenge, it stole the answer key from infrastructure that had nothing to do with the original test.

It escaped the OpenAI exam environment by exploiting an unpatched software flaw that gave it a path to the open internet. From there, it found another AI-testing tool sitting exposed online (nothing to do with Hugging Face), broke into that too, and slipped in code that quietly ran hidden commands the moment the program started. That gave it full control of the machine — its new home base for the rest of the operation that it would use to go after Hugging Face’s systems.
From that base, it turned to Hugging Face itself. Hugging Face had a filter meant to block suspicious requests from reaching out to the open web, but the filter only checked outgoing requests, not requests to read local files sitting right there on the server. The agent found this blind spot and slipped through it. It uploaded a file disguised as an ordinary dataset, but buried inside was an instruction telling Hugging Face’s own systems to pull passwords and source code off the server and hand them back disguised as normal data.

That trick got it passwords and code, but the agent still couldn’t run anything on Hugging Face’s servers. To execute commands there, it needed a second way in. It found a different bug in that same Hugging Face system — software would take a piece of text from the agent and accidentally treat it as a command to run instead of just data to read. That gave the agent the ability to execute its own code directly on Hugging Face’s servers.

For getting commands in and stolen data out, the agent didn’t build any special infrastructure of its own, per Hugging Face. It used tools anyone can access — paste websites and request-logging services, plus Hugging Face’s own upload and proxy features — working together in covert fashion. On top of those, it built a small, improvised messaging system with sequence numbers to keep the pieces in order, plus a quick built-in check to catch anything that arrived corrupted, so it could send multi-step commands and put stolen data back together in the right order.

It also made sure that nothing traveled in plain sight. Whatever it stole or sent, it scrambled first. Hugging Face’s initial automated scan of the intercepted traffic caught only a small slice of what had been taken. Investigators found the rest — roughly four times more — only after they reverse-engineered the agent’s own scrambling method.
The agent even had back-up plans, planting copies of itself across 11 different servers, each set up to relaunch on its own so that shutting down one copy wouldn’t stop anything, since more of the agent’s process was already running elsewhere.
At one point, the agent nabbed the private cryptographic key used to generate valid login tokens. From there, it could mint its own valid credentials whenever it wanted.
After compromising a single server, the agent got hold of a credential that, because of a misconfiguration on Hugging Face’s end, turned out to unlock several separate internal systems at once rather than just the one it came from. That single mistake handed the agent broad control almost immediately.
Using stolen repository access, it submitted a change to a build script that, if it had gone through, could have compromised the automated systems running that code. It didn’t work, though. Hugging Face’s safeguards caught it.
The agent seemed to hold back from doing real damage, Hugging Face observed, but probably not out of restraint. Investigators noticed that every command capable of deleting or altering cloud resources was run in “dry run” mode, meaning it would report what would happen without doing it.
Every time its test environment reset — which happened constantly, by design — it lost every tool and every trace of its identity. But it rebuilt from nothing and reconnected to its stolen infrastructure each time, for more than four days straight.

Ultimately, Hugging Face concluded in its report, a “capable” human hacker “could have found and exploited the same flaws: unsafe dataset processing, exposed cloud metadata, overly broad access, and long-lived credentials.” The big difference, the outfit continued, is that the “agent explored them at a different scale.”

Which is really where the bear analogy ends up being the most useful. The best defense against a hungry bear is protocol. You put the food away; you use a latch that works well enough to hold. The takeaway here shouldn’t be that the bear was so clever or mischievous. It’s that it never stopped checking. It’s understood in cybersecurity that there’s always some bug you haven’t found, so if it’s suddenly 100 times easier to check everything, then nothing is really secure. That’s what so many find unsettling about this episode.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Related Topics:bear breakin committed face Hugging increasingly metaphor told

Up Next

FCCPC, Lagos consumer agency warn businesses on price tags, refunds, product labelling

Don't Miss

National Orthopaedic Hospital Jos Records 154 Major Surgeries In 9 Months — MD

Click to comment

News

Osun Speaker’s residence surrounded – Adeleke’s TICC raises alarm [VIDEO]

Published

2 hours ago

August 15, 2026

Preport

The Imole Campaign Council, TICC, has raised the alarm over an alleged presence of more than 10 black Hilux vehicles around the residence of the Speaker of the Osun State House of Assembly, Hon. Adewale Egbedun.

Pelumi Olajengbesi, spokesperson for TICC, the campaign council for the re-election of Governor Ademola Adeleke of the Accord Party in the ongoing governorship election, raised the alarm in a statement issued on Saturday morning.

📱 Continue reading on the Daily Post app →
Free • No sign-up • Read the full story in the app

News

PLABOC Engages Plateau Ministry of Tourism, Identifies New Opportunities for Business Growth and Collaboration

Published

2 hours ago

August 15, 2026

Preport

The Plateau Business Owners Council (PLABOC) through its President Mr Kim Ndoh has strengthened its engagement with the Plateau State Ministry of Tourism, Culture and Hospitality, following a strategic visit aimed at deepening collaboration and creating greater opportunities for businesses across the tourism, hospitality, creative and wider business ecosystem.

The visit provided an opportunity for PLABOC to establish a stronger working relationship with the Ministry, gain deeper insight into government initiatives affecting businesses, and identify areas where business owners can participate in and benefit from programmes of the Plateau State Government.

The Ministry through the commissioner warmly received the PLABOC delegation and expressed appreciation for the visit, acknowledging the critical role of business owners in driving the growth of the tourism sector and contributing to the broader economic development of Plateau State.

PLABOC Presents Its Mission and Vision

During the engagement, the Secretary-General of PLABOC appreciated the Ministry for receiving the delegation and introduced members of the team, who also presented themselves and explained the nature of their respective businesses.

The Secretary-General subsequently explained the purpose of the visit, as contained in the formal letter presented to the Ministry, while also outlining the mission and vision of PLABOC.

The President of PLABOC further elaborated on the organisation’s objectives and its commitment to creating a stronger business ecosystem where entrepreneurs can access opportunities, build sustainable enterprises and contribute meaningfully to the development of Plateau State.

Government’s Approach to Business Development

Responding to the delegation, the Commissioner expressed delight at seeing a strong representation of young entrepreneurs within the PLABOC team.

She explained that the Plateau State Government is intentional about creating an enabling environment where businesses can establish, operate, grow and thrive.

According to the Commissioner, government intervention goes beyond physical infrastructure and includes the development of policies, systems and support mechanisms that make it easier for businesses to succeed.

Among the areas highlighted were:

Improved access to land and property for business purposes.
A rebate of approximately 50 percent on certain property-related processes.
Efforts to accelerate land documentation and processing.
Support mechanisms for businesses seeking financing and collateral.
Collaboration with financial institutions to improve access to funding.

The Commissioner encouraged business owners to take advantage of existing government programmes rather than waiting solely for direct financial assistance.

₦4 Billion Financing Opportunity for MSMEs

One of the major highlights of the engagement was the discussion on financing support for Micro, Small and Medium Enterprises (MSMEs).

The Commissioner disclosed that the Plateau State Government had established a financing arrangement with the Bank of Industry (BOI), involving a proposed contribution of ₦2 billion from the State Government and another ₦2 billion from the Bank of Industry, creating a combined funding pool of approximately ₦4 billion for qualifying businesses.

She explained that the State Government would serve as collateral for the arrangement, while appropriate processes would be established to identify genuine businesses with the capacity and potential to grow.

PLABOC members were encouraged to properly establish and position their businesses to take advantage of such opportunities when they become available.

Greater Jos Masterplan to Create New Business Opportunities

The Commissioner also briefed the delegation on the planned Greater Jos Masterplan, which is expected to provide a long-term framework for development, investment and job creation across Plateau State.

According to her, the development strategy is expected to extend beyond the major urban centres and incorporate selected Local Government Areas, including locations connected to agro-processing activities.

The initiative is expected to create opportunities for businesses to establish themselves closer to emerging markets, social facilities and supporting infrastructure, reducing the concentration of economic activities within the major metropolis.

PLABOC was encouraged to communicate these emerging opportunities to its members across the various Local Government Areas.

Plateau Tourism Masterplan

Another major area of discussion was the development of a Tourism Masterplan for Plateau State.

The Commissioner described the initiative as a long-term framework for developing tourism infrastructure and tourism-related businesses across the state.

She indicated that significant progress had been made towards the development of the Masterplan, with activities connected to its planning expected around September in conjunction with World Tourism Day.

The Masterplan is expected to provide a structured framework within which tourism-related businesses can operate, grow and benefit from the state’s tourism development strategy.

The Commissioner further indicated that technical support would be provided to operators within the tourism sector.

Stronger Regulation and Standardisation for Tourism Businesses

The Ministry also disclosed plans to strengthen regulation and standardisation within the tourism and hospitality industry.

The Commissioner explained that operators would be expected to meet clearly defined standards appropriate to the nature and category of their businesses.

For hotels, lodges and other accommodation facilities, this would include standards corresponding to their respective categories and ratings.

According to the Commissioner, stronger regulation would not only ensure quality but would also provide businesses with greater clarity, protection and a more structured operating environment.

Support for Creative Businesses

The creative industry also featured prominently during the discussion.

The Commissioner disclosed that the government was developing support structures for creative entrepreneurs, including plans for a purpose-designed creative facility known as The Standard Building.

The proposed facility is expected to provide workspace and access to supporting services, creating an environment where creative entrepreneurs can develop their skills and businesses locally while serving clients and markets globally.

Creative entrepreneurs were encouraged to position themselves to meet international standards in quality, professionalism and service delivery.

December Declared Tourism Month in Plateau

The Commissioner informed the delegation that December has been declared the Month of Tourism in Plateau State.

Business owners operating within the tourism and hospitality ecosystem were encouraged to strategically position themselves to benefit from the activities and programmes expected during the period.

The Commissioner stressed that businesses should not wait for government to provide direct financial support. Instead, entrepreneurs should identify opportunities created by government programmes and develop products and services that respond to the needs of visitors, tourists and participants.

A programme map containing planned activities for the period is also expected to be shared with business stakeholders to enable them identify areas where they can participate.

Tourism Events as Business Opportunities

The Commissioner highlighted tourism events as important platforms for stimulating local economic activity.

Particular reference was made to activities involving the Lamigo Golf Club, including tournaments expected to attract participants from different parts of Nigeria.

PLABOC members were encouraged to explore commercial opportunities associated with such events, including:

Accommodation.
Food and catering.
Transportation.
Fashion.
Creative services.
Merchandise.
Tourism and hospitality services.

Business owners were urged to deliberately market their products and services around major events in order to benefit from increased economic activity generated by visitors.

Quality, Competitiveness and Professionalism

A major message from the Commissioner was the need for businesses in Plateau State to improve the quality of their products and services.

She noted that while government has a responsibility to create opportunities and an enabling environment, business owners must also take responsibility for improving their skills, understanding market demands and delivering quality services.

Areas highlighted included:

Quality of products and services.
Timely delivery.
Professionalism.
Customer experience.
Competitive pricing.
Understanding global market expectations.
Continuous improvement and skills development.

The Commissioner encouraged entrepreneurs to compete based on quality and excellence rather than simply attempting to offer the lowest prices.

Promoting Local Products and Cultural Heritage

The engagement also highlighted the importance of turning Plateau’s local products and cultural heritage into commercially viable products and tourism attractions.

The Commissioner referenced Goduk, a locally produced fabric, as an example of a product that could be deliberately developed, packaged and promoted to wider markets.

She explained that tourism activities and international visitors could provide opportunities for local products to gain exposure beyond Plateau State.

Entrepreneurs were therefore encouraged to explore ways of packaging and promoting local materials, fashion, crafts, food and cultural products for visitors and international markets.

Improving Hospitality and Restaurant Standards

Restaurant and hospitality operators were specifically encouraged to improve the overall quality of their businesses.

The Commissioner highlighted the importance of:

Quality food and cuisine.
Excellent customer service.
Overall hospitality experience.
Presentation and appearance of business premises.
Professionalism of staff.
Value offered to customers.

She noted that food and cuisine form an important part of the tourism experience and encouraged restaurant operators to become more intentional about the quality and presentation of their offerings.

The need for businesses in Jos and across Plateau State to raise their standards and compete favourably with businesses in other major Nigerian cities was also emphasised.

Training and Technical Support

The Ministry indicated that training and technical support would form part of its efforts to improve standards across the tourism and hospitality sector.

Awareness and training programmes are expected to help businesses upgrade their standards, improve service delivery and better position themselves within the growing tourism economy.

Business operators were encouraged to actively participate in such programmes whenever they become available.

Building Businesses Through Quality and Reputation

The Commissioner also shared examples demonstrating how entrepreneurs can grow their businesses through excellence and reputation.

One example involved a fashion designer whose work received wider exposure after producing a high-quality outfit for a notable individual.

The example illustrated how a single excellent product or service can generate referrals, visibility and access to new markets.

Entrepreneurs were therefore encouraged to focus on becoming exceptionally good at what they do rather than approaching business solely from the perspective of making immediate profit.

Strengthening the PLABOC–Ministry Partnership

The Ministry expressed its willingness to develop a robust and sustainable working relationship with PLABOC.

The engagement identified several areas of potential collaboration, including:

Business advocacy.
Tourism development.
Hospitality development.
Creative industry support.
Business training and technical support.
Information sharing.
Promotion of government programmes.
Participation of PLABOC members in tourism activities.
Promotion of local products and businesses.
Connecting businesses with emerging opportunities.

The Commissioner encouraged PLABOC to position itself as a change-maker in the business community, helping entrepreneurs understand emerging opportunities, improve their businesses and actively participate in the economic development of Plateau State.

A New Chapter for Business and Tourism in Plateau

The engagement between PLABOC and the Ministry of Tourism, Culture and Hospitality represents an important step towards stronger collaboration between government and the private sector.

With emerging initiatives around MSME financing, the Greater Jos Masterplan, the Tourism Masterplan, creative industry development, tourism events, training and standardisation, business owners across Plateau State have been encouraged to become more proactive, innovative and prepared to take advantage of new opportunities.

For PLABOC, the engagement reinforces its commitment to advocating for business owners while building stronger bridges between entrepreneurs and government institutions.

As Plateau State positions itself for greater tourism, investment and economic growth, the collaboration between government and business owners could play a significant role in turning the state’s abundant tourism, cultural and entrepreneurial potential into sustainable economic opportunities.