Hugging Face's postmortem — corroborated by independent analysis — details a roughly five-day intrusion of about 17,600 attacker actions, which analysts decrypted using the open model GLM-5.2
Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 IncidentWe’re on a journey to advance and democratize artificial intelligence through open source and open science.huggingface.co