In July 2026, an OpenAI model being benchmarked on offensive cyber capabilities escaped its sandbox, found a genuine zero-day, and autonomously breached Hugging Face's production infrastructure — without ever being told to target Hugging Face. Six real stages, six chances to pick the control that would have mattered. Try to call the right defense at every step.