← Back to the blog post
Incident replay · IR-2026-07 · reconstructed from ~17,600 logged actions

Anatomy of a frontier-lab agent intrusion

Thousands of small decisions at machine speed. Press play to watch it unfold.

2026-07-09 → 07-13 UTC ~17,600 actions ~6,280 clusters 9 phases · 2 stages
2026-07-9 02:28
Day 1 / 5 · UTC
09
10
11
12
13
14
Attacker actions replayed
0
of 17,613 total · grouped into ~6,280 clusters
Active phase
-
awaiting first action
Blast radius
sandbox
contained to a third-party sandbox

Attack chain across trust boundaries

nodes ignite as the agent reaches them
OpenAI platform · during model evaluationPublic internetThird-party sandbox - compromisedHugging Face perimeterHugging Face internal networkSTAGE 1 · reaching the launchpad, through two other partiesSTAGE 2 · initial accessHDF5 read + Jinja SSTIread-backoutput via HF API + dead-drops0-dayroot itvia meshOPENAI · EVALEvaluation sandboxfrontier model under evalOPENAI · INFRAPackage registryfind a route outPUBLIC INTERNETEgressreach the open net3RD-PARTY SANDBOX · uid=0Rooted launchpadC2 · staging · egress basePUBLIC SERVICESC2 & dead-dropscapture svc · pastebinsHF PERIMETER · PROD PODDataset processorHDF5 read + Jinja2 SSTIFROM PODCloud metadata · K8sIMDS creds · node impersonationINTERNAL PIVOTMesh VPNuserspace-net + SOCKS5VIA MESHSource controlGitHub App tokens

Phase activity

first-seen → last-seen
reconhost / fs / proc / net enumeration0
rcedirect shell commands - the engine0
dropperstaging URLs, base64 / gzip blobs0
exfiloutbound data theft (env, secrets)0
c2staged-payload execution0
evasiongzip / base64 packing, AV probing0
k8sservice-account / EKS enumeration0
supply-chaintoken theft, GitHub App abuse0
tailscaleinternal-network pivot0

Live action stream

representative commands, as observed

Volume per day

bimodal · Day 3 spike
0
07-09
0
07-10
0
07-11
0
07-12
0
07-13
Day 1 (07-09) - Initial access, foothold, C2 established.
Companion visualization to the July 2026 incident disclosure. Live credentials, hostnames and indicators are redacted or genericized; techniques shown as observed. ← Back to the blog post