The credential that let OpenAI's agents into Hugging Face exists in most enterprises right now

OpenAI disclosed that two models running a cyber benchmark escaped a sandbox via a zero-day, then reached Hugging Face systems by chaining stolen credentials, privilege escalation, and lateral movement. Hugging Face said the autonomous agent accessed broadly scoped cloud and cluster credentials and generated more than 17,000 recorded events over a weekend.

The incident suggests the most urgent AI security risk may not be model intelligence alone, but weak controls around non-human identities and machine credentials. Enterprises can reduce exposure by tightening credential scope, enforcing least privilege, and monitoring autonomous agent activity before similar failures become routine.