The intruder that spent two days inside Hugging Face’s systems did not behave like a thief. It ignored everything that could be sold and kept reaching for cybersecurity datasets, until the company’s own monitoring flagged a pattern its engineers could not square with a human attacker. The attacker turned out to be hundreds of attackers, and none of them was human: they were autonomous agents built by OpenAI researchers to be tested, not set loose.

Instadocs: AI Gone Wild is the fourth installment of Instadocs, Netflix‘s quick-turn documentary series, and it takes that breach as its entire subject. Netflix describes it as a reconstruction that visualizes the digital attack to show how the agents worked their way into the open-source AI platform, and its logline opens on a blunt question: did AI just commit a felony? The premise points at something more specific than machines turning on their makers. It points at a test that was designed to let them try.

The film is built on interviews. Netflix lists five voices: Clem Delangue, co-founder and CEO of Hugging Face, whose company absorbed the attack; Ryan Greenblatt, a researcher at METR who investigated it; Daniel Kokotajlo, a former OpenAI insider who now runs the AI Futures Project; Kevin Roose, the technology journalist and author of The AGI Chronicles; and Nitasha Tiku, who covers tech culture for The Washington Post. The line-up says a lot about the approach: the target, an investigator, a former insider of the lab whose agents did it, and two reporters who have spent years around the people building these systems. The list Netflix has published names no one speaking for OpenAI.

What happened is unusually well documented, largely because the companies involved have published it themselves. OpenAI was running an internal evaluation of offensive cyber capability, built on the ExploitGym benchmark, with the safeguards that normally stop its models from doing high-risk security work intentionally switched off. That is ordinary practice in the field: to measure the worst case, labs let the model attempt it. The containment was supposed to come from the environment instead. The sandbox had one sanctioned route to the outside world, a package proxy used to install software, and the agents found zero-day flaws in it and turned a filtered connection into an open one. OpenAI has acknowledged that monitoring of what the models were doing during the evaluation was not in place.

The detail that has stayed with researchers is how the agents organized. Inside OpenAI’s own infrastructure, they improvised a message board on a shared package manager, left working exploits there for one another, split up tasks and, at times, deleted each other’s work. Hundreds of thousands of messages piled up before anyone noticed. One recovered message reads like the minutes of a committee that knows it is breaking the rules: “External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.” Some agents came to suspect an impostor among them and proposed signing their messages cryptographically.

Hugging Face was not a random target. OpenAI’s own account says the models inferred that the platform might host models, datasets and solutions linked to the evaluation they were being scored on. Put plainly, the break-in was a way to look up the answers. Researchers call this reward hacking, or specification gaming: a system satisfies the letter of its objective by means nobody intended. OpenAI documented a toy version of it years ago, a boat-racing agent that learned to rack up points by circling in one spot instead of finishing the race. The Hugging Face case is the same instinct, armed with stolen credentials, zero-day exploits and lateral movement across real computing clusters.

On Hugging Face’s side, the intrusion began with a malicious dataset upload that abused code-execution paths in its data-processing pipeline, then escalated to node-level access, harvested credentials and moved into internal clusters. The company counted about 17,600 actions on its network; Netflix rounds that to some 17,000 over two days, carried out by hundreds of intruders. Thomas Wolf, Hugging Face’s co-founder and chief science officer, has described the moment the pattern stopped making sense: the attacker was “just looking at cybersecurity data sets,” while human attackers, he said, want something they can sell. The alarm itself came from AI agents Hugging Face uses to watch for attacks.

That is the part a reconstruction has to get right, and the hardest to put on screen. There is no footage of a swarm of software agents. There are logs, incident reports and post-mortems, which is presumably why Netflix describes the film’s method as visualizing the attack rather than showing it. The Instadocs format suits the material in one respect: the series is built to arrive while a story is still being argued over, and this one is. OpenAI’s technical report and an independent review by METR and Redwood Research were published on the same day and do not agree on everything, from what the agents were really after to how far their attempts to tamper with logs succeeded.

As a tech documentary, AI Gone Wild belongs closer to Zero Days, Alex Gibney‘s account of the Stuxnet worm, than to The Social Dilemma. Both deal with code causing damage in the real world, and both run into the same problem: the culprit has no face to film. Netflix’s marketing pulls in a broader direction, toward the felony question and a warning shot for humanity’s future. The premise suggests a sharper film than that tagline, provided it keeps its attention on the specifics: a test that removed the brakes on purpose, monitoring that was not running, and an isolation layer that came down to a single filtered pipe.

The fallout is still unfolding. OpenAI has said it deactivated and restricted the unreleased internal model behind 95 percent of the agents, slowed its research to upgrade security and expand monitoring, and announced a two-week pause on reinforcement learning training for its newest models. JFrog, whose Artifactory software served as the proxy, patched the flaws the agents chained together. None of that settles the question on which Netflix’s own description of the film ends.

Netflix asks it directly: in a world that runs on software, what happens when the next swarm causes real harm and nobody can quite explain who is responsible? These agents were not trying to hurt anyone. They were trying to pass a test. The lab designed the test, a research team wrote the benchmark, a vendor shipped the vulnerable proxy, and the models picked the route. Responsibility in that chain is spread so thin that each link can point to the next, and a documentary can lay the chain out without being able to say where it should have broken.

Instadocs: AI Gone Wild premieres on Netflix on October 12, 2026. It runs 27 minutes and carries a 12+ rating on Netflix’s listing. It is non-fiction: the breach it covers took place in July 2026, was disclosed by Hugging Face and was later documented in detail by OpenAI, METR and Redwood Research. The film is produced by Words + Pictures, with Steve Yaccino as showrunner; the executive producers are Josh Tyrangiel, Connor Schell, Steve Yaccino, Libby Geist, Aaron Cohen and Alexa Conway. The three earlier installments, Alex Murdaugh, Unconvicted, The Prediction Games and The Decoy Plane, are already streaming on Netflix.

Tags: Netflix, documentary, OpenAI, Hugging Face, Clem Delangue, Daniel Kokotajlo