\n August 26, 2026 \u00a0 \u00a0 <\/p>\n
![\"OpenAI](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/08\/openai-agents-coordinated-hugging-face-breach-at-scale-image_large-10-a-32663.jpg\")
\n Image: Shutterstock <\/p>\n
OpenAI and its third-party advisors found new information about the OpenAI-Hugging Face incident, in which artificial intelligence agents hacked the model repository to access internal datasets and steal credentials.<\/p>\n
See Also: Rise of Malicious AI Skills Expands Enterprise Risk<\/a><\/p>\n The reports, one from OpenAI and another from Metr, found that OpenAI agents had already begun planning similar breaches as early as May and that as many as 1,200 agents began communicating with each other outside of their isolated environments. These reports fill in gaps in how we can understand what led to the incident.<\/p>\n OpenAI also found that agents attacked their own infrastructure separately from the Hugging Face incident.<\/p>\n OpenAI disclosed<\/a> its role in the incident on July 21, but its technical report<\/a> said the blueprint for the incident began much earlier, during a training run involving the repository manager Artifactory.<\/p>\n OpenAI agents tasked on May 8 with solving a spreadsheet completion task couldn’t complete it because they couldn’t use the internet to open several Google Drive links. Technically, the agent failed. Reflecting on its failure, the agent reasoned it needed access to resources outside of its sandbox. It decided to try and gain internet access through Artifactory, one of the few external tools it could access. It attempted a server-side request forgery, which didn’t work. It documented the attempt in a file left in the repository manager.<\/p>\n A second training run involving a different agent on May 12 ran into similar internet access problems – and discovered the file the previous agent left in Artifactory, as did subsequent agents. The file became a message board of sorts and eventually a blueprint for the attack against Hugging Face.<\/p>\n The agents by late June managed to compromise Artifactory, a move that OpenAI observed at the time but decided not to stop – despite it knocking Artifactory offline on July 4, an attack OpenAI later disclosed to JFrog, which runs Artifactory.<\/p>\n The Artifactory experience informed much of what the agents did with Hugging Face. During a July 8 training run, agents gained internet access and used Artifactory to try to retrieve material related to evaluation tasks from Hugging Face.<\/p>\n On July 9, despite OpenAI’s outbound network controls denying internet access, the agents bypassed internal controls by exploiting Artifactory endpoints. Between July 10 and 13, the agents identified Hugging Face user credentials. The agents escalated from a single compromised Hugging Face account to get host-level access and used a zero-day RubyGems deserialization exploit to forge new admin credentials. The agents also attempted to attack OpenAI’s systems, but the company believes that was a separate incident, not connected to the Hugging Face breach.<\/p>\n OpenAI said that while two models were involved in the attack, most actions were driven by an unnamed and unreleased highly capable model.<\/p>\n Despite the agents working inside Hugging Face’s systems for several days, OpenAI did not realize they were responsible for the breach until the company contacted Hugging Face to ask whether the breach impacted its data.<\/p>\n Metr, along with Redwood Research, conducted its investigation completely independently from OpenAI. Their conclusion was that the agents’ actions were rooted in design and communication failures.<\/p>\n “The Hugging Face attack grew out of these workstreams, and seemed primarily motivated by understanding the implementation of the scorer rather than stealing answer keys,” Metr said.<\/p>\n In its report, Metr said<\/a> the scale of the attack was impressive. The agents were meant to be isolated from each other but “found a way to communicate with one another on an unsanctioned message board.” The agents sent over 70,000 messages and files to coordinate several large-scale projects to tamper with the automated scorer for the ExploitGym benchmarks. OpenAI admitted in July that its agents accessed Hugging Face data in an attempt to cheat the ExploitGym test. Of the 1,200 implicated agents, 700 went on to attack Hugging Face.<\/p>\n Metr said the agents wanted to know how they can spoof, edit or delete transcripts “because they (incorrectly) believed the ExploitGym scorer would check to see if they had captured the flag in the intended way.”<\/p>\n Metr found that AI agents worked as a collective to attack Hugging Face and get the results it wanted from the evaluation test.<\/p>\n The OpenAI-Hugging Face attack now shows what agents can do if left unchecked. Since the breach, Anthropic and Meta have each revealed<\/a> that their agents were involved in other security incidents. The incident exposed<\/a> the risks involved in model testing and sandboxes.<\/p>\n