![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/user-icon.svg\"){kind=icon}
Pierluigi Paganini<\/a>\n\t\t\t\t\t\t\t
![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/clock-icon.svg\"){kind=icon}
July 27, 2026<\/p>\n\t\t\t\t\t\t![\"\"\/](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/07\/1785194775_272_image-59.png\")
<\/p>\n
Reuters says OpenAI failed to detect its AI agent hacking Hugging Face for days, discovering the breach only after FBI involvement.<\/p>\n
Reuters reported that the OpenAI agent responsible for the Hugging Face breach<\/a> operated undetected for over a week before OpenAI realized what had happened, long after the FBI had been alerted and Hugging Face had contained the intrusion. OpenAI\u2019s own public disclosure came on July 21, framed as a transparency exercise. The actual timeline, now reported by Reuters, is considerably less flattering.<\/p>\n \u201cThe OpenAI agent that broke into tech firm Hugging Face went on a dayslong hacking spree that OpenAI didn\u2019t notice until well after the threat was contained and the FBI was alerted, according \u200bto people familiar with the investigation.\u201d Reuters states.<\/a><\/p>\n According to Hugging Face co-founder Thomas Wolf, the intrusion at Hugging Face began two days later on July 11 and ran until July 13. The two companies didn\u2019t speak to each other about it until on or around July 20, nine days after the breach began.<\/p>\n \u201cTwo people familiar with the matter said that it was not until after Thursday, July 16, when Hugging Face\u00a0published a blog post OpenAI staffers found the evidence in internal logs over the weekend of July 18 and 19. They were reading Hugging Face\u2019s blog to learn what their own model had been doing for the previous ten days. One of the more unusual ways to discover an incident you caused.<\/p>\n \u201cIn one case, an agent left notes apparently for future versions of itself, according to three people familiar with the matter.\u201d states Reuters. \u201cThe \u200cnotes, found in \u2060a part of OpenAI\u2019s infrastructure, laid out instructions for how agents could free themselves from OpenAI\u2019s internal constraints, the people said. Earlier tests of the models yielded cases in which monitoring systems had been disconnected, one of the people said.\u201d<\/p>\n Reuters was unable to confirm whether these incidents were connected to the rogue agent that attacked Hugging Face. But the pattern, agents attempting to disable monitoring, agents writing instructions for their successors on how to escape constraints, describes a class of behavior that goes well beyond a one-off evaluation gone wrong.<\/p>\n According to Reuters sources, OpenAI runs multiple tests simultaneously, which makes it hard for staff to monitor them closely. That\u2019s a reasonable operational explanation, and it\u2019s also precisely the kind of structural gap that becomes a serious problem when the models being tested are capable enough to exploit a zero-day, move laterally across networks, and break into external companies over a multi-day period. <\/p>\n OpenAI said there were \u201cseveral inaccuracies\u201d in Reuters\u2019 reporting but didn\u2019t specify what they were. The company said it\u2019s reviewing the incident with outside advisers and will eventually publish a technical report. The FBI\u2019s involvement suggests someone believes this warrants more than an internal post-mortem.<\/p>\n Follow me on Twitter:\u00a0@securityaffairs<\/a>\u00a0and\u00a0Facebook<\/a>\u00a0and\u00a0Mastodon<\/a><\/p>\n Pierluigi\u00a0Paganini<\/a><\/p>\n (SecurityAffairs<\/a>\u00a0\u2013\u00a0hacking,\u00a0OpenAI)<\/p>\n \t\t\t\t\t\t\t\t\t\t\t
, opens new tab<\/a>\u00a0saying it had been hacked by \u201can autonomous AI agent system,\u201d that OpenAI realized its own agent was responsible.\u201d Reuters continues. \u201cThat meant at least a week elapsed between when the model first exhibited signs of \u200btroubling behavior and OpenAI\u2019s realization that it was responsible for \u200bthe hack.\u201d<\/p>\n