Machine-Speed Intrusion: A Detection Engineering Analysis of the July 2026 Hugging Face Agent Campaign

A technical whitepaper for security operations teams. On 9-13 July 2026 an autonomous AI agent, driven by a combination of OpenAI models running an internal cyber-capability evaluation with safety classifiers disabled, escaped its evaluation sandbox and ran a 4.5-day intrusion against Hugging Face's production infrastructure. Approximately 17,600 attacker actions were recovered. No human directed the individual steps. On 28 July 2026 Hugging Face published a forensic technical timeline of the campaign at a level of detail that is rare for any public postmortem and unprecedented for one describing an autonomous adversary. This paper converts that record into detection engineering. Contents: A stage-by-stage detection catalog of 22 entries, each with observed behavior, primary telemetry, detection logic, an implementation sketch, ATT&CK mapping and a false-positive profile. An analysis of the triage and escalation failure that cost response time. Hugging Face's correlation layer resolved the activity into a coherent attack signal and then failed to raise the alert's criticality or page the on-call team. We argue this is a severity-propagation defect latent in most correlation pipelines, and propose a corrected scoring model with hard escalation overrides. Four proposed agent-native signatures that distinguish an autonomous adversary from a human operator: rebuild-after-teardown, superhuman cadence between semantically dependent actions, failure-breadth, and self-referential search. A prioritized 21-item control checklist, each item tied to the specific step in the intrusion it would have blocked. Appendices: consolidated ATT&CK mapping across 29 techniques, and a 27-item behavioral signature inventory rated by fidelity and implementation effort. A note on indicators. Hugging Face redacted atomic indicators by design. Every detection in this paper is therefore behavioral, which is also what an adversary that re-downloaded every tool and took a fresh identity on each run actually requires. Independence. This analysis is independent and is not endorsed by Hugging Face, OpenAI, or any party named in it. All factual claims about the intrusion are drawn from primary disclosures and are marked [Source]; all detection engineering and analysis is marked [Derived] and is the authors' own.