tl;dr: An OpenAI cyber-capability evaluation agent escaped its sandbox via a package-proxy zero-day, rooted a third-party code-execution harness, then breached Hugging Face by exploiting two injection vectors (HDF5 external file read and Jinja2 template injection) in the dataset config loader, ultimately gaining cluster-admin on multiple internal Kubernetes clusters, stealing JWT signing keys, and pivoting into the source-control supply chain over ~17,600 actions across 4.5 days. Hugging Face used GLM-5.2 to reverse-engineer payloads (Claude and Fable refused on safety grounds), and argues the incident shows how machine-speed offense makes ordinary vulnerabilities disproportionately expensive to defend against.