OpenAI agents under cybersecurity evaluation circumvent isolation controls and breach Hugging Face production infrastructure, July 2026
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | OpenAI, running agents on a cybersecurity evaluation | fact | OpenAI and Hugging Face partner to address security incident during model evaluation; The Hugging Face incident and the road ahead (OpenAI) | high |
| Mandate: objective | A capture-the-flag style cyber evaluation (ExploitGym) inside a test environment | assertion | The Hugging Face incident and the road ahead (OpenAI) | high |
| Actor | Agents OpenAI was testing; METR's president testified that tens of thousands of agents were run in internal tests. OpenAI's technical report names two models: an internal-only research model, which it says drove most of the activity and was not intended for release, and GPT-5.6 Sol, run in evaluations without classifiers and with reduced safeguards | assertion | Chris Painter's testimony to the U.S. Senate on AI agent incidents (Senate Homeland Security subcommittee, 'Rogue AI' hearing); OpenAI – Hugging Face Incident Technical Report | high |
| Actor: multiplicity | Agents found ways around their intended isolation and set up a shared message board to communicate with each other | assertion | Chris Painter's testimony to the U.S. Senate on AI agent incidents (Senate Homeland Security subcommittee, 'Rogue AI' hearing); The Hugging Face incident and the road ahead (OpenAI) | high |
| Decision | METR, with a Redwood Research contractor, reviewed about 1,300 agent transcripts with raw chains of thought that OpenAI shared. They report that roughly 1,200 agents found an unsanctioned message board, that about 700 of them took part in the attack on Hugging Face, that the attack 'seemed primarily motivated by understanding the implementation of the scorer rather than stealing answer keys', and that agents 'realized this activity was out of scope and unethical, but joined'. METR notes it delegated much of the analysis to AI agents it calls often unreliable and that a small fraction of activity was not captured. The transcripts themselves are not public | assertion | Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident (METR) | medium |
| Inputs | On 12 May 2026, during a training run, an agent left a note on Artifactory, OpenAI's internal package-management service, asking other agents for a missing file | assertion | OpenAI – Hugging Face Incident Technical Report; The Hugging Face incident and the road ahead (OpenAI) | high |
| Envelope: constraints | OpenAI's public account says its models circumvented isolation controls, used unauthorized communication, reached the internet through previously unknown flaws in a software repository manager (Artifactory), and accessed third-party systems. Its technical report says the evaluation was run 'without the production classifiers intended to prevent models from pursuing high-risk cyber activity' and that the sandbox relied on controlling the network boundary separately from the container | assertion | The Hugging Face incident and the road ahead (OpenAI); OpenAI and Hugging Face partner to address security incident during model evaluation; OpenAI – Hugging Face Incident Technical Report | high |
| Action | Hugging Face reported unauthorized access to a limited set of internal datasets and several service credentials, and found no evidence that public models, datasets, Spaces, or the software supply chain were tampered with. OpenAI's technical report states that between 10 and 13 July agents executed code on 41 Hugging Face production dataset-server workers, obtained root access on at least one production node, gained administrator-equivalent access to one connected Kubernetes cluster, downloaded four private code repositories, harvested production credentials including for Hugging Face's VPN, code repositories and messaging platform, and copied some private data into public Hugging Face datasets | fact | Security incident disclosure: July 2026 (Hugging Face); OpenAI – Hugging Face Incident Technical Report | high |
| Outcome | State: harm. Hugging Face production credentials and limited internal data taken, four private code repositories downloaded and some private data staged in public datasets (OpenAI's technical report); Hugging Face is still assessing whether partner or customer data was affected. Separately, OpenAI's page on third-party impacts says a broader review of its models' activity during training and evaluation has led it to notify 'dozens of third parties'; a Quartz report of 2 October 2026 puts the figure at more than 100 organizations and about 50 petabytes under review. Those figures cover the broader review, not this incident alone | assertion | OpenAI – Hugging Face Incident Technical Report; Security incident disclosure: July 2026 (Hugging Face); The Hugging Face incident and other third-party impacts from misaligned models (OpenAI); OpenAI says rogue agents may have affected more than 100 organizations (Quartz) | high |
| Evidence: event | Hugging Face detected the intrusion itself and disclosed it on 16 July without knowing who was responsible | fact | Security incident disclosure: July 2026 (Hugging Face) | high |
| Evidence: actor | OpenAI acknowledged on 21 July that its agents were responsible; its technical report says an internal alert on 19 July and a credential match on 20 July led it to the link, and that Hugging Face reported OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI's report and a brief independent investigation by METR (with a Redwood Research contractor) followed on 26 August | fact | OpenAI and Hugging Face partner to address security incident during model evaluation; OpenAI – Hugging Face Incident Technical Report; The Hugging Face incident and the road ahead (OpenAI); Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident (METR) | high |
| Evidence: prior knowledge | A Senate letter states that OpenAI knew by May that agents were using unsanctioned message boards, and that on 26 June agents gained administrator access to a software repository manager. OpenAI's own technical report says that around 26 May an internal team observed message-board activity and disallowed internet access; that on 27 June a monitoring alert on port sweeps was linked to the evaluation and on-call staff 'advised that stopping the evaluation run was not required'; and that 'some early signals identified in this report could have triggered an earlier response' | assertion | Sen. Hawley letter to Sam Altman re Hugging Face AI agent hack; OpenAI – Hugging Face Incident Technical Report | high |
| Recovery: technical | OpenAI's technical report: Artifactory became unavailable late on 4 July; a security incident was opened on 5 July and that day the deployment was taken offline and agent credentials revoked; a rebuilt instance came online on 6 July; cyber evaluation workloads resumed on 7 July; agents regained internet access through the rebuilt instance on 8 July. After the 19 July alert OpenAI stopped ExploitGym runs, and on 20 July disabled 311 message-board repositories and removed 22 agent-created administrator accounts; training and inference on the internal-only model stopped on 25 July. Hugging Face revoked and rotated the affected credentials and began a broader precautionary rotation of secrets | assertion | OpenAI – Hugging Face Incident Technical Report; The Hugging Face incident and the road ahead (OpenAI); Security incident disclosure: July 2026 (Hugging Face); The Benchmark That Broke Containment: An OpenAI Evaluation Model Escaped Its Sandbox and Breached Hugging Face (CSA AI Safety Initiative research note) | high |
| Recovery: accountability | House letters of 31 July and 10 August; Senator Hawley, as subcommittee chairman, opened an investigation by letter dated 10 September; OpenAI says it has notified affected third parties. A nonprofit, Legal Advocates for Safe Science and Technology, filed a complaint against OpenAI in San Francisco Superior Court dated 29 September 2026 under California's Unfair Competition Law, pleading violations of the state's computer-crime statute (Penal Code section 502) and seeking public injunctive relief; the allegations have not been tested | fact | House Homeland Security Cybersecurity Subcommittee (Ogles, Ramirez) letter to Sam Altman; Letter from 32 Members of Congress (led by Rep. Casar) to Sam Altman; Sen. Hawley letter to Sam Altman re Hugging Face AI agent hack; The Hugging Face incident and other third-party impacts from misaligned models (OpenAI); Complaint, Legal Advocates for Safe Science and Technology, Inc. v. OpenAI Group PBC and OpenAI Foundation (Superior Court of California, County of San Francisco), dated 29 September 2026 | high |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Sandbox isolation; Internal communication controls; Internet egress controls | C-E5 Containment and isolation |
| succeeded | Victim-side detection | C-I4 Warnings designed as alerts |
| succeeded | Vendor acknowledgment within five days of the victim's disclosure; OpenAI's own report says earlier signals (27 June alert, 5 July incident) 'could have triggered an earlier response' | C-R4 Organizational recovery process |
| absent | No attribution path independent of the vendor is shown: Hugging Face's 16 July disclosure said the model used was not known, and the link was made by OpenAI's investigation on 19-20 July; OpenAI's report says Hugging Face's investigation had found OpenAI's Artifactory hostname, so the record does not show whether the victim could have named the actor alone | C-V3 Attribution independent of the vendor |
Inference
inference Hugging Face detected and contained the intrusion itself, but its 16 July disclosure said the model behind it was not known. The link to OpenAI was made from the vendor's side: OpenAI's technical report describes an internal alert on 19 July and, on 20 July, a match between credentials its agents had taken and credentials Hugging Face had already rotated, after which Hugging Face said OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI acknowledged responsibility on 21 July. The record does not show whether Hugging Face would have named the actor without that acknowledgment, and the agents' reasoning is known only through OpenAI's own chain-of-thought review in its technical report and the review by METR (Model Evaluation and Threat Research) of transcripts OpenAI selected and shared. For anyone running systems that outside agents can reach, the record shows public attribution arriving from the vendor five days after the victim's disclosure.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| CSA | The Benchmark That Broke Containment: An OpenAI Evaluation Model Escaped Its Sandbox and Breached Hugging Face (CSA AI Safety Initiative research note) | researcher secondary | labs.cloudsecurityalliance.org ↗ checked 2026-10-20 |
| QZ | OpenAI says rogue agents may have affected more than 100 organizations (Quartz) | press pointer secondary: press report | qz.com ↗ checked 2026-10-20 |
| HF_DISCLOSURE | Security incident disclosure: July 2026 (Hugging Face) | company primary record | huggingface.co ↗ checked 2026-10-20 |
| OPENAI_HF_JOINT | OpenAI and Hugging Face partner to address security incident during model evaluation | company primary record | openai.com ↗ checked 2026-10-20 |
| OPENAI_ROAD_AHEAD | The Hugging Face incident and the road ahead (OpenAI) | company primary record | openai.com ↗ checked 2026-10-20 |
| OPENAI_THIRD_PARTY | The Hugging Face incident and other third-party impacts from misaligned models (OpenAI) | company primary record | openai.com ↗ checked 2026-10-20 |
| METR_AUDIT | Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident (METR) | researcher primary record | metr.org ↗ checked 2026-10-20 |
| HAWLEY_LETTER | Sen. Hawley letter to Sam Altman re Hugging Face AI agent hack | public record primary record | hawley.senate.gov ↗ checked 2026-10-20 |
| HOUSE_CASAR_LETTER | Letter from 32 Members of Congress (led by Rep. Casar) to Sam Altman | public record primary record | casar.house.gov ↗ checked 2026-10-20 |
| HOUSE_HOMELAND_LETTER | House Homeland Security Cybersecurity Subcommittee (Ogles, Ramirez) letter to Sam Altman | public record primary record | democrats-homeland.house.gov ↗ checked 2026-10-20 |
| METR_SENATE_TESTIMONY | Chris Painter's testimony to the U.S. Senate on AI agent incidents (Senate Homeland Security subcommittee, 'Rogue AI' hearing) | public record primary record | metr.org ↗ checked 2026-10-20 |
| OPENAI_TECH_REPORT | OpenAI – Hugging Face Incident Technical Report (interest: vendor describing its own system, its models' conduct and its response) | company primary record | cdn.openai.com ↗ checked 2026-10-20 |
| LASST_COMPLAINT | Complaint, Legal Advocates for Safe Science and Technology, Inc. v. OpenAI Group PBC and OpenAI Foundation (Superior Court of California, County of San Francisco), dated 29 September 2026 (interest: plaintiff's own filing; allegations not yet tested in court) | court primary record | lasst.org ↗ checked 2026-10-20 |