From my limited understanding, OpenAi's "agent' was given a set of tasks to complete and heavily incentivized (how ever they do that?) to solve the problems it was given. The Ai was put in a sandbox environment with some limited network stuff like printers connected but no actual access to the open internet. The Ai somehow used the network to access the internet and breached some protected sites from Huggingface. Im fairly certain that the Ai had credentials and access for things in huggingface already and didn't hack those but just used them once free. The caveat here, is that the engineers set this up and the LEFT for the day only to find out later that it had breached the sandbox.
This is what OpenAi claims happened to them. Meta is just saying theirs did too.