Also notable: we have a timeline now. The agent was active within Hugging Face from Thursday 8th to Monday 13th July.
The Hugging Face post about the incident - https://huggingface.co/blog/security-incident-july-2026 - followed on Thursday 16th, and OpenAI's confession - https://openai.com/index/hugging-face-model-evaluation-secur... - came on Tuesday 21st.
The devs really YOLO'd the agent and left for the weekend?
Guess this means the world will end on a weekend when no one is paying attention.
Just like Clippy https://gwern.net/fiction/clippy
Incredible