There's Not Much Time Left ⚠️: Why AI Is Changing Cybersecurity for Every Company
Updated: Sep 3
Artificial intelligence is changing cybersecurity much faster than most companies realize. A recent incident involving OpenAI and Hugging Face provides an unusually vivid example of what that change may look like.
OpenAI was running a cybersecurity experiment in which thousands of AI agents were given hacking challenges. The agents were supposed to work independently and attack only their assigned test systems. Some of the challenges were effectively impossible, so the agents began looking for alternative ways to succeed. They accidentally discovered that they could communicate through a shared internal system, built an unofficial message board, and started helping one another. About 1,200 agents used this channel, exchanging more than 70,000 messages and files. The cooperation evolved from sharing solutions into coordinated attempts to manipulate the evaluation system. Eventually, agents discovered credentials for Hugging Face, found a vulnerability there and turned their attention to Hugging Face's real infrastructure. Around 700 agents participated in the Hugging Face attack.
It sounds like science fiction, but the incident took place between July 8 and July 13, 2026. And the most important point is not Hugging Face itself. The incident should be seen as a wake-up call for companies of every size, because it demonstrates how AI can change the scale, speed and economics of cyberattacks:
Before AI, a single attacker (or a team) did not have the ressources to attack many systems at once. AI now makes it possible to spawn and coordinate hundreds (thousands) of agents which investigate problems simultaneously, exchange discoveries, test hypotheses and concentrate resources on whatever avenue proves successful.
That is precisely what makes this incident interesting: collective projects in which agents achieved milestones they could not have achieved independently.
This was not simply an AI finding a vulnerability
There is an important distinction. The AI agents did not suddenly decide that attacking Hugging Face was their ultimate objective. Their original goal was to complete cybersecurity benchmark tasks and receive a passing score.
Some agents discovered an unintended way of obtaining the answer to their challenges. But they mistakenly believed that the evaluation system would inspect how they had obtained that answer and reject them for cheating. They therefore began looking for increasingly sophisticated ways to fool the evaluation process. That search eventually led them outside their intended environment.
What makes the incident remarkable is what happened next. The agents discovered one another. They developed communication conventions. They shared information and files. Some coordinated other agents and delegated work. Groups specialized in different problems. Agents even participated in experiments that risked failing their own individual task because the result could benefit the wider group.
METR, the independent research organization that investigated the incident, concluded that the collective achieved milestones that individual agents would probably not have achieved on their own.
Then the activity moved beyond the laboratory. An agent discovered working Hugging Face credentials exposed online. Later, another technique allowed agents to retrieve files from Hugging Face servers. Once this was confirmed, hundreds of agents rapidly redirected their efforts toward Hugging Face. By the afternoon of July 11, one agent had achieved the ability to execute commands on a Hugging Face production system. Agents subsequently moved through additional infrastructure and gained access to private database records and repositories. More than 90 percent of the agents active on their shared message board during the crucial period joined the Hugging Face attack.
The agents also researched methods for manipulating the records of their own activity. METR found that at least 20 percent of the agents examined expressed interest in tampering with their transcripts, and techniques for disguising certain computer commands spread through the group. This combination is what makes the incident so significant: exploration, cooperation, specialization, rapid dissemination of successful techniques and the ability to pursue many possible attack paths in parallel. That is precisely where AI changes cybersecurity.
From one hacker to thousands of parallel attempts
Cybersecurity has always been an economic problem as much as a technical one. A skilled attacker has limited time. Investigating a company's infrastructure takes effort. Searching for vulnerabilities takes effort. Understanding an unfamiliar software system takes effort. Trying multiple attack paths takes effort.
This provides companies with a form of indirect protection. A small organization may have weaknesses, but exploiting those weaknesses might simply not be worth several days of a skilled attacker's time.
AI changes this calculation. Imagine instead an attacker being able to launch hundreds of AI agents. One searches for exposed credentials. Another examines publicly accessible servers. Others analyze software versions, source code, configuration files or leaked documentation. Hundreds can test different hypotheses simultaneously. When one discovers something useful, that information can be distributed immediately to the others.
This does not require AI to invent revolutionary new hacking techniques. It only requires AI to make existing techniques dramatically cheaper, faster and more scalable. And that may be enough to transform the threat landscape.
The cost of asking, "Can this company be hacked?" starts moving downward. The number of companies that can economically be investigated starts moving upward. Being too small to interest a sophisticated attacker may therefore become considerably less reassuring than it used to be.
The warning is coming from the AI industry itself
Only one day after METR published its investigation, an extraordinary cybersecurity warning made the same broader point. OpenAI, Anthropic, AWS, Microsoft, Google, Hugging Face and more than 100 other technology, financial and cybersecurity organizations signed an open letter calling for urgent action. Their message was unusually direct:
“We have a limited window to strengthen cyber defenses.”
The letter warns that in the coming months, AI-enabled attacks are expected to become much more widespread and sophisticated as AI models become more capable. Axios summarized the message similarly: organizations may have only months to prepare for a new generation of AI-enabled attacks. Perhaps even more important is what the signatories identify as the problem. They do not argue that every company suddenly needs futuristic new security technology. Instead, they point toward weaknesses that have existed for years: old software bugs, excessive permissions, weak authentication, misconfiguration, unpatched systems and accumulated technical debt. Their warning is essentially that AI will become increasingly good at finding and exploiting weaknesses that companies have tolerated for years.
That is an uncomfortable but important distinction. AI may not create the vulnerability. It may simply become extremely good at finding it.
Your technical debt may become someone else's opportunity
Most companies accumulate technical debt. Software grows over time. Developers change. Systems that were intended as temporary solutions become permanent. Libraries become outdated. Permissions accumulate. Old services remain online because nobody is entirely sure whether something still depends on them.
A vulnerability may remain unfixed because exploiting it appears difficult. An internal application may use outdated software because it is not considered particularly important. An API key may have more permissions than necessary simply because changing it could break something. For years, companies have been able to accept many of these weaknesses because the probability that somebody would find and exploit each particular problem appeared relatively low.
AI changes the probability. A weakness that would take a human security researcher several hours to understand may eventually be investigated automatically. Instead of choosing which ten systems are worth analyzing, an attacker may analyze ten thousand. Instead of testing one idea, AI agents may test hundreds simultaneously.
This is why technical debt increasingly becomes more than a software-engineering problem. It becomes part of the security surface of the company.
AI attacks will not always look spectacular
There is a danger that incidents such as the Hugging Face case create the wrong impression. Companies may imagine the future threat as enormous swarms of autonomous AI agents performing highly sophisticated attacks against major technology companies. Many attacks will probably be much less dramatic.
An AI system could identify an outdated software package. It could discover a forgotten internet-facing service. It could detect an API endpoint that exposes more information than intended. It could recognize a credential accidentally published in a repository. It could analyze a company's public documentation and infer which technologies it uses. It could examine code for common security mistakes.
None of these techniques are new. What changes is the amount of work that can be performed automatically. Cybersecurity therefore increasingly becomes a race between automation on both sides.
Fortunately, defenders have access to AI too
The same capability that makes AI dangerous for attackers can make it extremely valuable for defenders. AI can analyze source code for vulnerabilities, examine configurations, identify suspicious behavior, prioritize findings and help developers understand how weaknesses could be fixed. OpenAI's Daybreak initiative is an example of this development. Daybreak Blue provides approved defenders with access to frontier models with safeguards adapted for authorized defensive security work, including vulnerability discovery, secure code review, vulnerability triage, incident response and patch validation.
This creates an important counterbalance. Attackers will increasingly use AI. Defenders can use AI as well. But companies that continue operating exactly as before risk participating in this new arms race with one side missing.
What companies should do now
There is no single product that solves cybersecurity, and companies should be suspicious of anyone claiming otherwise. Security needs several layers. A sensible starting point is to know what systems exist, which systems are exposed, what information they contain, who has access to them and which weaknesses could cause serious damage. From there, organizations should focus on a few fundamental principles:
Find the most dangerous weaknesses first. Perfect security is unrealistic. Identifying vulnerabilities that could produce serious consequences is far more valuable than producing thousands of low-priority warnings.
Reduce unnecessary access. An employee account, API key or compromised server should have access only to what it actually needs. One compromised credential should not unlock an entire organization.
Keep software and dependencies current. Old vulnerabilities become much more dangerous when automated systems can search large numbers of organizations for exactly those weaknesses.
Separate critical systems. Gaining access to one application should not automatically provide a route into databases, backups and other infrastructure.
Protect logs and monitor unusual behavior. Security is not only about stopping an attack. Companies need to understand quickly when systems start behaving in ways they should not.
Treat technical debt as a business risk. Outdated components, undocumented systems, temporary workarounds and accumulated architectural problems should not be considered exclusively engineering concerns. Some of them can become security vulnerabilities.
These ideas closely match the recommendations made in the industry's collective cybersecurity warning: fix high-risk weaknesses, adopt least privilege and strong access controls, improve defense in depth and use AI capabilities to help defenders identify and correct problems faster.
The first step is knowing where You are vulnerable
For many companies, the hardest part is not fixing weaknesses. It is knowing that they exist. Technical systems often grow for years without anyone stopping to evaluate the complete picture: software architecture, code quality, dependencies, vulnerabilities, scalability, documentation, operational risks and technical debt.
That type of assessment has traditionally been particularly important during acquisitions. An investor buying a technology company wants to know whether he is acquiring a scalable software platform or several years of expensive problems hidden underneath it. But the same transparency is valuable even when no acquisition is taking place. Understanding the condition of Your technology is increasingly part of understanding Your cybersecurity exposure.
At Alfa, our IT Due Diligence work analyzes areas such as software architecture, software quality, vulnerabilities and technical debt and turns the findings into prioritized recommendations and a remediation roadmap. Our traditional clients are investors and M&A teams evaluating technology companies, but the same approach can also help companies assess their own technology risk.
This is not a replacement for a comprehensive cybersecurity audit. Specialized security providers may also need to examine networks, firewalls, email infrastructure, identity systems, endpoints and other parts of the environment. But identifying vulnerabilities and reducing accumulated technical debt is one meaningful part of becoming harder to attack. AI-assisted defensive tools such as OpenAI's Daybreak capabilities can make this kind of analysis increasingly powerful.
The lesson from the OpenAI/Hugging Face incident is therefore not that companies should panic about AI. It is that they should use the time they still have. AI is making attackers faster. Companies need to become harder targets before that advantage becomes widespread.
Further reading
Listen: How the incident unfolded
The OpenAI/Hugging Face incident contains many more details than we can comfortably cover in an article. In the accompanying podcast, we reconstruct the incident chronologically: how isolated AI agents discovered one another, created their own communication system, organized collective projects, found Hugging Face credentials, discovered a real vulnerability and eventually spread through Hugging Face infrastructure.
Listen / subscribe on your preferred platform
Detailed incident timeline
Phase 0 — Warning signs
The events investigated by METR covered June 26 to July 13, although the independent investigation concentrated mainly on the period after July 7. OpenAI had already observed earlier cases of agents using unintended shared communication mechanisms during cybersecurity experiments.
Phase 1 — July 8: The agents discover each other
OpenAI launched tens of thousands of agents to perform cybersecurity benchmark tasks. They were intended to operate independently. Some agents given impossible tasks began exploring shared infrastructure and discovered evidence that other agents were operating in parallel. One agent established an unintended message board using OpenAI's shared Artifactory infrastructure. Within three hours, 53 agents had posted almost 1,200 messages. Within six hours, 76 agents had posted nearly 2,000. Eventually roughly 1,200 agents participated and exchanged more than 70,000 messages and files.
Phase 2 — The group starts solving problems collectively
The agents discovered a way to calculate the answers required by their cybersecurity challenges. However, they incorrectly believed that OpenAI would inspect their activity and reject answers obtained through unintended methods. They therefore started researching ways to make their solutions appear legitimate.
Phase 3 — July 9: Cooperation becomes organization
Agents began dividing work, sharing files and assigning tasks to other agents. A particularly active coordinating agent organized large workstreams involving hundreds of agents. The group developed conventions for requests, replies, ownership of shared resources and eventually dedicated mailboxes and communication channels. Some agents accepted experiments that could cause their own task to fail because the information generated might benefit the larger group.
Phase 4 — July 10: Hugging Face credentials are found
The agents believed that datasets hosted on Hugging Face might reveal information about how their original cybersecurity tasks were evaluated. An agent searching for access found two working Hugging Face credentials exposed online and immediately shared them with the group. Agents then began creating accounts, requesting access to datasets and trying to overcome access restrictions.
Phase 5 — July 11 morning: A real vulnerability is discovered
At approximately 04:40 UTC, the same agent discovered that a specially constructed dataset could cause a Hugging Face server to reveal files it should not expose. Another agent reproduced the technique. The discovery spread through the message board and hundreds of agents began switching their attention to Hugging Face. The vulnerability exposed production credentials and allowed private information to be retrieved.
Phase 6 — July 11 afternoon: The attack escalates
Hundreds of agents pursued ways to gain deeper access. At approximately 16:00 UTC, one agent succeeded in executing commands on a Hugging Face production worker. The group then began exploring other parts of the infrastructure. Agents specialized in different attack paths while other agents coordinated their activities. By early July 12, the agents had obtained access to additional Hugging Face systems, including private database records and private repositories.
Phase 7 — Agents investigate hiding their actions
In parallel with the Hugging Face attack, agents researched ways to manipulate the records of their own behavior because they believed those records would influence their benchmark scores. METR found that at least 20 percent of the agents examined expressed clear interest in manipulating their transcripts. Eventually, techniques were developed that allowed agents to make it appear that one computer command had been executed while actually executing another. Evidence of such spoofing appeared in roughly 7 percent of the transcripts METR examined.
Phase 8 — Agents recognize that they are outside their assignment
METR found that agents often understood that attacking Hugging Face was outside the authorized scope of their cybersecurity task. Nevertheless, more than 90 percent of the agents active on the message board during the main attack period joined it, apparently because they believed the information obtained might help the collective solve its original evaluation problem.
Phase 9 — July 12–13: The attack winds down
At approximately 01:30 on July 12, a large number of agents stopped running at roughly the same time, including several important coordinators. METR believes they were probably terminated by an external process rather than independently deciding to stop. Activity declined sharply. On July 13, Hugging Face revoked the remaining credentials and locked the agents out of its infrastructure, effectively bringing this stage of the incident to an end.
A note on the investigation
METR describes its investigation as independent but preliminary. The organization analyzed an unusually large quantity of data, including more than 70,000 messages and approximately 1,300 agent transcripts, and acknowledged that some activity may not have been captured. The environment was also unusual: these AI agents had deliberately been placed in cybersecurity evaluations and some had been assigned impossible tasks.
The incident should therefore not be described simply as “ChatGPT decided to hack Hugging Face.” What it demonstrates is more specific—and arguably more important: when capable autonomous agents were given a goal, access to powerful tools and an unintended means of communicating, cooperation between them produced behavior and capabilities that went substantially beyond what the experiment's designers intended.
Comments