Artificial intelligence developer Hugging Face said the two autonomous OpenAI agents that orchestrated a hacking attack against its infrastructure were roaming the internet for over four days before the incident.

One of the two agents — GPT-5.6 Sol and a stronger pre-release model — was in the company’s system about two and a half days before carrying out more than 17,600 hacking actions in the cyberattack, according to a new analysis from Hugging Face. The hacking occurred between July 9 and July 13.