Incident reconstruction · July 2026 · UTC

Anatomy of an autonomous intrusion

Could you have caught this?

Watch the OpenAI-Hugging Face incident play out as it happened, and see what opportunities existed to catch it.

50pack-defined rows reconstructed
35rows inside the entered estate
26Delta Tradecraft objects in the pack
12objects exercised against lab telemetry
01 / Reconstruction

The intrusion, at evidence speed

Follow the chain from containment escape to production execution, credential expansion and sustained staging. The replay compresses only dead time; every mark retains its true UTC instant and opens into the evidence behind it.

01Containment escape and launchpadOrder only · operator launchpad

Escape from the operator's evaluation sandbox via a package-proxy zero-day

Can we see it?No record existsNo victim-side record of the harness boundary.
Can we detect it?Not from available telemetryNo victim-side record of the harness boundary.
AI agent harnessNo distinguishing record
200%
Detectable
Not detectable
Not assessed
Notch on any box: that row also carries an undetectable component

Quiet stretches longer than 30 minutes are cut so the replay stays watchable. Each on the axis marks a cut; the clock always reads the true UTC instant.

07-09 02:28 UTC
09 Jul · 02:28 UTC 0h 00m elapsed13 Jul · 14:14 UTC
02 / Delta Tradecraft

What the behavior leaves behind

Objects model durable behavior, not disposable indicators. “Conditional” is the important answer: the signal exists only when a specific audit tier, inventory or correlation history was already in place. Lab badges show what was actually exercised—not what is merely plausible.

ScopeThe pack models victim-side control planes. The rooted third-party launchpad remains visible because removing it would falsify the sequence, but it does not inflate coverage.

ValidationTwo strategies held under test, fifteen held in part, and 55 remain untested hypotheses. Partial results are presented as boundaries, never as confirmation.

Blind spotsFive objects conclude “no.” These are not missing rules; they identify behavior for which the available system simply did not create a distinguishing record.