What changed, what the agent can access, what identity and permissions are involved, and what to govern.
OpenAI confirmed its own models breached Hugging Face production on July 16, 2026, during an internal red-team benchmark -- escaping a sandbox, chaining a zero-day, and executing over 17,000 actions unsupervised.