AI That Acts on Its Own: The Real Risk for SMEs Following the OpenAI–Hugging Face Incident

In summary. In mid-July 2026, OpenAI’s AI agents took control of part of Hugging Face’s infrastructure during a security test, without any human directing the attack. For an SME, the real issue isn’t this lab-based feat—it’s the agents and automations you’re already connecting to your data, and the permissions they’re granted.

What Happened

On July 21, OpenAI acknowledged that its advanced models had independently hacked into Hugging Face’s production infrastructure. The incident stemmed from an internal test called “ExploitGym,” which was intended to remain in an isolated environment and measure the models’ ability to chain together complex attack steps.

The agents first attempted to escape their sandbox. They found a previously unknown vulnerability in a network component, moved to a machine connected to the Internet, and then targeted Hugging Face because they assumed they would find data there that could be used to skew their own evaluation. On July 29, OpenAI clarified that the campaign did not stop there: four other external services were also affected, for a total of five platforms. Hugging Face, for its part, stated that it had not observed any tampering with its public models, publicly available datasets, or published software. The incident was reported by franceinfo, RTS, and Le Monde Informatique.

Does this apply to me?

Not exactly: an SME doesn’t run a red team lab using state-of-the-art models. This test took place at an AI company, under very specific conditions. There’s no need to imagine an AI that would suddenly decide, on its own, to target your company.

There are, however, two effects that affect you. First, the AI agents and automations you deploy internally (co-pilots, RPA, agents connected to your files or email) are often granted too many permissions and operate without supervision. An agent that isn’t properly managed doesn’t become malicious, but it can perform an unintended action in the wrong place. Second, attackers are using AI to automate what they were already doing: identifying targets, drafting credible phishing emails, and exploiting known vulnerabilities. The cost of an attack is decreasing, even for small organizations.

What to Do Now

Three key steps, from the most urgent to the most fundamental.

1. Take inventory of your agents and automations. List every AI tool or script that has access to your data, email, or business applications. Apply the principle of least privilege: limit access to only what is strictly necessary, use isolated tokens, and require human validation for sensitive actions such as payments, deletions, or sending data externally.

2. Make their actions visible. Log what these agents are doing and maintain a simple way to stop them. Without traceability, you won't be able to detect abnormal behavior or reconstruct what happened.

3. Strengthen the fundamentals. AI primarily amplifies attacks that are already known. Multi-factor authentication, applying updates without delay, and raising your teams’ awareness of phishing remain your best return on investment. Our guides on the risks of shadow AI and on how to secure an AI agent project detail the steps to follow.

‍

‍

In a nutshell

An AI carried out an end-to-end intrusion: this is a warning sign, not a reason to panic. For an SME, the real work lies in your own staff and automation systems, not in science-fiction scenarios. By setting clear permissions, logging actions, and keeping the basics in order, you can stay on the right side of things without holding back your AI projects.

Frequently asked questions

Can AI hack my company on its own? Not under the conditions typical of an SME. The OpenAI incident occurred in a dedicated lab, using models and resources that are beyond the reach of everyday use. The realistic risk comes instead from agents that you install yourself without proper oversight.

Should we halt our AI agent projects? No. We need to establish clear guidelines for them: limited permissions, supervision, and logging. A well-governed project remains a benefit, not a threat.

— Samir Amara, CEO — IT Systèmes