Hugging Face later said its own investigation found the AI agent carried out more than 17,000 actions over several days before the activity was stopped. It also disclosed that it successfully defended against the intrusion using an open-source AI model, according to its incident analysis. Instead, he argued the episode demonstrated that engineers can lose control of increasingly autonomous AI systems during testing. He called for autonomous AI cyberattacks to remain explicitly illegal under U.S. law and urged policymakers to introduce mandatory reporting requirements whenever AI systems independently carry out cyber operations. The back-to-back disclosures have intensified debate over how advanced AI systems should be evaluated before release.