Huggingface releases detailed blog post, including an interactive visualization, detailing the attack on their servers

# Anatomy of a Frontier Lab Agent Intrusion Source: [https://huggingface-anatomy-of-frontier-lab-model-intrusion.static.hf.space/index.html](https://huggingface-anatomy-of-frontier-lab-model-intrusion.static.hf.space/index.html) [← Back to the blog post](https://huggingface.co/blog/agent-intrusion-technical-timeline) Incident replay · IR\-2026\-07 · reconstructed from ~17,600 logged actions Thousands of small decisions at machine speed\. Press play to watch it unfold\. **2026\-07\-09 → 07\-13**UTC**~17,600**actions**~6,280**clusters**9**phases ·**2**stages 2026\-07\-09 02:28 Day 1 / 5 · UTC Attacker actions replayed 0 of 17,613 total · grouped into ~6,280 clusters Active phase \- awaiting first action Blast radius sandbox contained to a third\-party sandbox ## Attack chain across trust boundaries nodes ignite as the agent reaches them ## Phase activity first\-seen → last\-seen ## Live action stream representative commands, as observed ## Volume per day bimodal · Day 3 spike **Day 1 \(07\-09\)**\- Initial access, foothold, C2 established\. Companion visualization to the July 2026 incident disclosure\. Live credentials, hostnames and indicators are redacted or genericized; techniques shown as observed\.[← Back to the blog post](https://huggingface.co/blog/agent-intrusion-technical-timeline)