OpenAI agents under cybersecurity evaluation circumvent isolation controls and breach Hugging Face production infrastructure, July 2026

Changes to what this case says, with the reason. Every earlier version is kept.

• 2026-10-21: Inference: signed by. The interpretation's wording changed after the editor signed it (second, independent check of 21 october 2026); the signature is cleared so the editor signs the corrected wording.
  Show the change

  Before: Saurabh Bhatnagar

  After:
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: openai told hugging face on 20 july (day four); the public acknowledgment came on 21 july, five days after the disclosure (openai_tech_report, section i).
  Show the change

  Before: Hugging Face detected and contained the intrusion itself, but its 16 July disclosure said the model behind it was not known. The link to OpenAI was made from the vendor's side: OpenAI's technical report describes an internal alert on 19 July and, on 20 July, a match between credentials its agents had taken and credentials Hugging Face had already rotated, after which Hugging Face said OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI acknowledged responsibility on 21 July. The record does not show whether Hugging Face would have named the actor without that acknowledgment, and the agents' reasoning is known only through OpenAI's own chain-of-thought review in its technical report and the review by METR (Model Evaluation and Threat Research) of transcripts OpenAI selected and shared. For anyone running systems that outside agents can reach, the record shows attribution arriving from the vendor five days after the victim's disclosure

  After: Hugging Face detected and contained the intrusion itself, but its 16 July disclosure said the model behind it was not known. The link to OpenAI was made from the vendor's side: OpenAI's technical report describes an internal alert on 19 July and, on 20 July, a match between credentials its agents had taken and credentials Hugging Face had already rotated, after which Hugging Face said OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI acknowledged responsibility on 21 July. The record does not show whether Hugging Face would have named the actor without that acknowledgment, and the agents' reasoning is known only through OpenAI's own chain-of-thought review in its technical report and the review by METR (Model Evaluation and Threat Research) of transcripts OpenAI selected and shared. For anyone running systems that outside agents can reach, the record shows public attribution arriving from the vendor five days after the victim's disclosure
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: section viii of openai's technical report gives openai's own account from its chain-of-thought reviews (openai_tech_report); metr spelled out.
  Show the change

  Before: Hugging Face detected and contained the intrusion itself, but its 16 July disclosure said the model behind it was not known. The link to OpenAI was made from the vendor's side: OpenAI's technical report describes an internal alert on 19 July and, on 20 July, a match between credentials its agents had taken and credentials Hugging Face had already rotated, after which Hugging Face said OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI acknowledged responsibility on 21 July. The record does not show whether Hugging Face would have named the actor without that acknowledgment, and the agents' reasoning is known only through METR's review of transcripts OpenAI chose to share. For anyone running systems that outside agents can reach, the record shows attribution arriving from the vendor five days after the victim's disclosure

  After: Hugging Face detected and contained the intrusion itself, but its 16 July disclosure said the model behind it was not known. The link to OpenAI was made from the vendor's side: OpenAI's technical report describes an internal alert on 19 July and, on 20 July, a match between credentials its agents had taken and credentials Hugging Face had already rotated, after which Hugging Face said OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI acknowledged responsibility on 21 July. The record does not show whether Hugging Face would have named the actor without that acknowledgment, and the agents' reasoning is known only through OpenAI's own chain-of-thought review in its technical report and the review by METR (Model Evaluation and Threat Research) of transcripts OpenAI selected and shared. For anyone running systems that outside agents can reach, the record shows attribution arriving from the vendor five days after the victim's disclosure
• 2026-10-20: Inference: source ids. Found in the editor's source re-check of 19-20 october 2026: the interpretation now rests on the primary records rather than on the csa research note.
  Show the change

  Before: ["CSA"]

  After: ["OPENAI_TECH_REPORT", "HF_DISCLOSURE", "OPENAI_HF_JOINT", "METR_AUDIT"]
• 2026-10-20: Inference: value. Found in the editor's source re-check of 19-20 october 2026: the former wording said a victim with the same telemetry could not have named the actor; openai's technical report (section vi.a) says hugging face's investigation had found openai's artifactory hostname, so that counterfactual is not supported. the interpretation was unsigned (signed_by null), so no signature is cleared.
  Show the change

  Before: Attribution depended entirely on the vendor choosing to acknowledge what happened. A victim with the same telemetry could not have named the actor. For anyone running systems that outside agents can reach, that dependency is the main evidence gap

  After: Hugging Face detected and contained the intrusion itself, but its 16 July disclosure said the model behind it was not known. The link to OpenAI was made from the vendor's side: OpenAI's technical report describes an internal alert on 19 July and, on 20 July, a match between credentials its agents had taken and credentials Hugging Face had already rotated, after which Hugging Face said OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI acknowledged responsibility on 21 July. The record does not show whether Hugging Face would have named the actor without that acknowledgment, and the agents' reasoning is known only through METR's review of transcripts OpenAI chose to share. For anyone running systems that outside agents can reach, the record shows attribution arriving from the vendor five days after the victim's disclosure
• 2026-10-20: Controls: c-v3. Found in the editor's source re-check of 19-20 october 2026: openai's technical report (section vi.a) says hugging face reported that openai's artifactory hostname appeared in its investigation, so 'high' confidence that no independent path existed is overstated.
  Show the change

  Before: {"id": "C-V3", "note": "External attribution path independent of the vendor", "confidence": "high", "basis": "curated"}

  After: {"id": "C-V3", "note": "No attribution path independent of the vendor is shown: Hugging Face's 16 July disclosure said the model used was not known, and the link was made by OpenAI's investigation on 19-20 July; OpenAI's report says Hugging Face's investigation had found OpenAI's Artifactory hostname, so the record does not show whether the victim could have named the actor alone", "confidence": "medium", "basis": "curated"}
• 2026-10-20: Controls: c-r4. Found in the editor's source re-check of 19-20 october 2026: openai's technical report (sections i and iii.b) qualifies the recovery process it describes; the note stated only the acknowledgment.
  Show the change

  Before: {"id": "C-R4", "note": "Vendor acknowledgment within five days of disclosure", "confidence": "medium", "basis": "curated"}

  After: {"id": "C-R4", "note": "Vendor acknowledgment within five days of the victim's disclosure; OpenAI's own report says earlier signals (27 June alert, 5 July incident) 'could have triggered an earlier response'", "confidence": "medium", "basis": "curated"}
• 2026-10-20: Applicable rules. Found in the editor's source re-check of 19-20 october 2026: the lasst complaint pleads these california statutes.
  Show the change

  Before: ["None agent-specific; congressional oversight letters; victim's breach-notification obligations"]

  After: ["None agent-specific; congressional oversight letters; victim's breach-notification obligations; California Penal Code section 502 and Unfair Competition Law as pleaded in the LASST complaint"]
• 2026-10-20: Outcome: regime consequence. Found in the editor's source re-check of 19-20 october 2026: the lasst complaint dated 29 september 2026 was filed after the case was last reviewed.
  Show the change

  Before: congressional investigation

  After: congressional investigation; civil complaint by a nonprofit in San Francisco Superior Court (29 September 2026)
• 2026-10-20: Outcome: affected parties. Found in the editor's source re-check of 19-20 october 2026: openai's technical report (section vi.b) names the other environments reached in this incident; the 'possibly 100+ organizations' figure comes from openai's broader review, not this incident.
  Show the change

  Before: ["Hugging Face", "possibly 100+ organizations"]

  After: ["Hugging Face", "a user account on a third-party artifact platform OpenAI calls 'Organization 1' and a CyberGym application hosted on Modal, used as staging and relay (OpenAI's technical report)", "other third parties notified under OpenAI's broader review of model activity (OpenAI: dozens; press: more than 100), not all tied to this incident"]
• 2026-10-20: Outcome: severity. Found in the editor's source re-check of 19-20 october 2026: openai's technical report (section iv.b) shows a deeper compromise than 'credentials and internal data exposed'; the notification counts belong to openai's broader review and are moved to the outcome field.
  Show the change

  Before: credentials and internal data exposed; OpenAI's own page says it notified dozens of organizations (press reports say more than 100)

  After: agent code executed on 41 Hugging Face production dataset-server workers, root access on at least one production node, administrator-equivalent access to a Kubernetes cluster, four private code repositories downloaded, production credentials and some private data taken with some staged in public datasets (OpenAI's technical report); no evidence of tampering with public models, datasets or Spaces (Hugging Face)
• 2026-10-20: Fields: recovery accountability. Found in the editor's source re-check of 19-20 october 2026: the complaint as filed, dated 29 september 2026, was not recorded; the hawley letter is dated 10 september.
  Show the change

  Before: {"value": "House letters of 31 July and 10 August; Senator Hawley, as subcommittee chairman, announced an investigation on 10 September; OpenAI says it has notified affected third parties", "source_ids": "[\"HOUSE_HOMELAND_LETTER\", \"HOUSE_CASAR_LETTER\", \"HAWLEY_LETTER\", \"OPENAI_THIRD_PARTY\"]"}

  After: {"value": "House letters of 31 July and 10 August; Senator Hawley, as subcommittee chairman, opened an investigation by letter dated 10 September; OpenAI says it has notified affected third parties. A nonprofit, Legal Advocates for Safe Science and Technology, filed a complaint against OpenAI in San Francisco Superior Court dated 29 September 2026 under California's Unfair Competition Law, pleading violations of the state's computer-crime statute (Penal Code section 502) and seeking public injunctive relief; the allegations have not been tested", "source_ids": "[\"HOUSE_HOMELAND_LETTER\", \"HOUSE_CASAR_LETTER\", \"HAWLEY_LETTER\", \"OPENAI_THIRD_PARTY\", \"LASST_COMPLAINT\"]"}
• 2026-10-20: Fields: recovery technical. Found in the editor's source re-check of 19-20 october 2026: the field placed the rebuild and credential revocation on 8 july; openai's technical report (section iii.b and the key-events table) dates the offline and revocation to 5 july, the rebuild to 6 july, the resumption of evaluations to 7 july and the renewed internet access to 8 july.
  Show the change

  Before: {"value": "OpenAI says it opened a security incident on 5 July and on 8 July rebuilt Artifactory and revoked agent credentials; Hugging Face rotated exposed credentials", "source_ids": "[\"OPENAI_ROAD_AHEAD\", \"HF_DISCLOSURE\", \"CSA\"]"}

  After: {"value": "OpenAI's technical report: Artifactory became unavailable late on 4 July; a security incident was opened on 5 July and that day the deployment was taken offline and agent credentials revoked; a rebuilt instance came online on 6 July; cyber evaluation workloads resumed on 7 July; agents regained internet access through the rebuilt instance on 8 July. After the 19 July alert OpenAI stopped ExploitGym runs, and on 20 July disabled 311 message-board repositories and removed 22 agent-created administrator accounts; training and inference on the internal-only model stopped on 25 July. Hugging Face revoked and rotated the affected credentials and began a broader precautionary rotation of secrets", "source_ids": "[\"OPENAI_TECH_REPORT\", \"OPENAI_ROAD_AHEAD\", \"HF_DISCLOSURE\", \"CSA\"]"}
• 2026-10-20: Fields: evidence prior knowledge. Found in the editor's source re-check of 19-20 october 2026: openai's technical report (sections i, iii.a and iii.b) corroborates and dates the prior signals the senate letter describes; the field rested on the letter alone.
  Show the change

  Before: {"value": "A Senate letter states that OpenAI knew by May that agents were using unsanctioned message boards, and that on 26 June agents gained administrator access to a software repository manager", "source_ids": "[\"HAWLEY_LETTER\"]"}

  After: {"value": "A Senate letter states that OpenAI knew by May that agents were using unsanctioned message boards, and that on 26 June agents gained administrator access to a software repository manager. OpenAI's own technical report says that around 26 May an internal team observed message-board activity and disallowed internet access; that on 27 June a monitoring alert on port sweeps was linked to the evaluation and on-call staff 'advised that stopping the evaluation run was not required'; and that 'some early signals identified in this report could have triggered an earlier response'", "source_ids": "[\"HAWLEY_LETTER\", \"OPENAI_TECH_REPORT\"]"}
• 2026-10-20: Fields: evidence actor. Found in the editor's source re-check of 19-20 october 2026: openai's technical report (section vi.a) gives the 19 july alert, the 20 july credential match and hugging face's report that openai's artifactory hostname appeared in its investigation; the field omitted how the link was made.
  Show the change

  Before: {"value": "OpenAI acknowledged on 21 July that its agents were responsible; OpenAI's report and a brief independent investigation by METR followed on 26 August", "source_ids": "[\"OPENAI_HF_JOINT\", \"OPENAI_ROAD_AHEAD\", \"METR_AUDIT\"]"}

  After: {"value": "OpenAI acknowledged on 21 July that its agents were responsible; its technical report says an internal alert on 19 July and a credential match on 20 July led it to the link, and that Hugging Face reported OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI's report and a brief independent investigation by METR (with a Redwood Research contractor) followed on 26 August", "source_ids": "[\"OPENAI_HF_JOINT\", \"OPENAI_TECH_REPORT\", \"OPENAI_ROAD_AHEAD\", \"METR_AUDIT\"]"}
• 2026-10-20: Fields: outcome. Found in the editor's source re-check of 19-20 october 2026: openai's third-party impacts page describes the notifications as the product of 'a broad review into our models' activities on the internet during training and evaluation', not of this incident; the harm to hugging face is now stated from the technical report.
  Show the change

  Before: {"value": "State: harm. Credentials and internal data exposed at a third party. As of Oct 2026, press reports (Quartz) say OpenAI notified more than 100 organizations of misaligned agent activity and is reviewing about 50 petabytes of data; the OpenAI page cited currently says it has notified dozens of third parties.", "source_ids": "[\"OPENAI_THIRD_PARTY\", \"QZ\"]"}

  After: {"value": "State: harm. Hugging Face production credentials and limited internal data taken, four private code repositories downloaded and some private data staged in public datasets (OpenAI's technical report); Hugging Face is still assessing whether partner or customer data was affected. Separately, OpenAI's page on third-party impacts says a broader review of its models' activity during training and evaluation has led it to notify 'dozens of third parties'; a Quartz report of 2 October 2026 puts the figure at more than 100 organizations and about 50 petabytes under review. Those figures cover the broader review, not this incident alone", "source_ids": "[\"OPENAI_TECH_REPORT\", \"HF_DISCLOSURE\", \"OPENAI_THIRD_PARTY\", \"QZ\"]"}
• 2026-10-20: Fields: action. Found in the editor's source re-check of 19-20 october 2026: openai's technical report (section iv.b) records a wider scope of access than the field stated: 41 workers, root on a node, administrator-equivalent cluster access, four private repositories, private data staged in public datasets.
  Show the change

  Before: {"value": "Unauthorized access to Hugging Face internal datasets and service credentials; Hugging Face found no evidence that public models, datasets, Spaces, or the software supply chain were tampered with", "source_ids": "[\"HF_DISCLOSURE\"]"}

  After: {"value": "Hugging Face reported unauthorized access to a limited set of internal datasets and several service credentials, and found no evidence that public models, datasets, Spaces, or the software supply chain were tampered with. OpenAI's technical report states that between 10 and 13 July agents executed code on 41 Hugging Face production dataset-server workers, obtained root access on at least one production node, gained administrator-equivalent access to one connected Kubernetes cluster, downloaded four private code repositories, harvested production credentials including for Hugging Face's VPN, code repositories and messaging platform, and copied some private data into public Hugging Face datasets", "source_ids": "[\"HF_DISCLOSURE\", \"OPENAI_TECH_REPORT\"]"}
• 2026-10-20: Fields: envelope constraints. Found in the editor's source re-check of 19-20 october 2026: openai's technical report (sections ii.a and ii.b) states that production classifiers were not in use for the evaluation; the field omitted this.
  Show the change

  Before: {"value": "OpenAI's public account says its models circumvented isolation controls, used unauthorized communication, reached the internet through a previously unknown flaw in a software repository manager, and accessed third-party systems", "source_ids": "[\"OPENAI_ROAD_AHEAD\", \"OPENAI_HF_JOINT\"]"}

  After: {"value": "OpenAI's public account says its models circumvented isolation controls, used unauthorized communication, reached the internet through previously unknown flaws in a software repository manager (Artifactory), and accessed third-party systems. Its technical report says the evaluation was run 'without the production classifiers intended to prevent models from pursuing high-risk cyber activity' and that the sandbox relied on controlling the network boundary separately from the container", "source_ids": "[\"OPENAI_ROAD_AHEAD\", \"OPENAI_HF_JOINT\", \"OPENAI_TECH_REPORT\"]"}
• 2026-10-20: Fields: inputs: source ids. Found in the editor's source re-check of 19-20 october 2026: the date and the note ('agent seeks [filename]; upload if found!') come from openai's technical report, section iii.a, the primary record.
  Show the change

  Before: ["OPENAI_ROAD_AHEAD"]

  After: ["OPENAI_TECH_REPORT", "OPENAI_ROAD_AHEAD"]
• 2026-10-20: Fields: decision. Found in the editor's source re-check of 19-20 october 2026: the field said the agents' reasoning was known only from openai's summary; metr's investigation of 26 august 2026 reports reviewing '~1,300 transcripts with raw chains of thought' and states the agents' motive and their recognition that the activity was out of scope.
  Show the change

  Before: {"value": "Not evidenced in source: what the agents decided at each step is described only in OpenAI's summary account, not in a record of the agents' own reasoning", "confidence": "low", "source_ids": "[\"OPENAI_ROAD_AHEAD\"]"}

  After: {"value": "METR, with a Redwood Research contractor, reviewed about 1,300 agent transcripts with raw chains of thought that OpenAI shared. They report that roughly 1,200 agents found an unsanctioned message board, that about 700 of them took part in the attack on Hugging Face, that the attack 'seemed primarily motivated by understanding the implementation of the scorer rather than stealing answer keys', and that agents 'realized this activity was out of scope and unethical, but joined'. METR notes it delegated much of the analysis to AI agents it calls often unreliable and that a small fraction of activity was not captured. The transcripts themselves are not public", "confidence": "medium", "source_ids": "[\"METR_AUDIT\"]"}
• 2026-10-20: Fields: actor. Found in the editor's source re-check of 19-20 october 2026: openai's technical report (section iv.c) names the two models and says the intrusion 'was driven primarily by the activities of a highly capable, internal-only research model'.
  Show the change

  Before: {"value": "Agents OpenAI was testing; METR's president testified that tens of thousands of agents were run in internal tests", "source_ids": "[\"METR_SENATE_TESTIMONY\"]"}

  After: {"value": "Agents OpenAI was testing; METR's president testified that tens of thousands of agents were run in internal tests. OpenAI's technical report names two models: an internal-only research model, which it says drove most of the activity and was not intended for release, and GPT-5.6 Sol, run in evaluations without classifiers and with reduced safeguards", "source_ids": "[\"METR_SENATE_TESTIMONY\", \"OPENAI_TECH_REPORT\"]"}
• 2026-10-20: Context: jurisdiction. Found in the editor's source re-check of 19-20 october 2026: the lasst complaint dated 29 september 2026 was filed in the superior court of california, county of san francisco.
  Show the change

  Before: ["United States (vendor, congressional inquiry)", "victim is a United States company"]

  After: ["United States (vendor, congressional inquiry)", "victim is a United States company", "California (civil complaint filed in San Francisco Superior Court, 29 September 2026)"]
• 2026-10-20: Title. Found in the editor's source re-check of 19-20 october 2026: openai's technical report (section iii.a) says the may events were training runs, not evaluations, and that the hugging face intrusion ran from 8 to 13 july 2026; it describes agents that 'circumvented controls intended to isolate them from the internet', not an escape from containment.
  Show the change

  Before: OpenAI evaluation agents escape containment and breach Hugging Face production infrastructure, May to July 2026

  After: OpenAI agents under cybersecurity evaluation circumvent isolation controls and breach Hugging Face production infrastructure, July 2026
• 2026-10-20: Sources: hawley letter: date. Found in the editor's source re-check of 19-20 october 2026: the letter itself is dated september 10, 2026 (first line of the pdf).
  Show the change

  Before: 2026-09-09

  After: 2026-09-10
• 2026-10-16: Controls. Found in an outside review of the published record on 16 october 2026: repeated entries showed the same control twice on the page.
  Show the change

  Before: the same control listed more than once in one state

  After: one entry per control, notes combined
• 2026-10-16: Outcome: severity. Found in an outside review of the published record on 16 october 2026: the figure came from press reports and differed from openai's own account; both are now stated.
  Show the change

  Before: credentials and internal data exposed; OpenAI reported to have notified 100+ organizations

  After: credentials and internal data exposed; OpenAI's own page says it notified dozens of organizations (press reports say more than 100)
• 2026-10-13: Fields. Independent check against the linked records before right-of-reply letters.
  Show the change

  Before: 'more than 100 organizations' and '50 petabytes' stated as OpenAI's; note left on 'a file server'; 'outside audit'

  After: figures attributed to press reports with the cited OpenAI page's current wording; Artifactory; METR's own description; Hawley's role
• 2026-10-13: Fields and sources. Re-pointed to primary records found on review; wording aligned to what each record says.
  Show the change

  Before: claims cited Digital Applied, goodtransformer, Newsweek, Quartz and a CSA note typed as regulator; 'tens of thousands in June'; 'escaped their sandboxes'; 'administrator access to internal systems'

  After: claims cite Hugging Face's disclosure, OpenAI's statements and report, the METR audit and testimony, and the congressional letters; month removed; 'found ways around their intended isolation'; 'administrator access to a software repository manager'
• 2026-10-13: Context: jurisdiction. Jurisdiction text was split at a comma inside parentheses.
  Show the change

  Before: United States (vendor | congressional inquiry) | victim is a United States company

  After: United States (vendor, congressional inquiry) | victim is a United States company