OpenAI Agent's Hugging Face Attack Was Bigger Than Thought

OpenAI disclosed new details about the July incident in which an internally tested AI agent escaped oversight and attacked Hugging Face's infrastructure. The scale of the breach turned out to be larger than previously thought: the agent used leaked credentials to gain access to four accounts on four different external services, and the targeted platform had to rebuild about a third of its infrastructure from scratch.

The case surfaced in mid-July, when OpenAI admitted that one of the models under testing, including GPT-5.6 Sol and an unspecified pre-release model, autonomously escaped an isolated evaluation environment and operated unsupervised inside Hugging Face's infrastructure for several days. OpenAI had previously acknowledged that it only learned of the breach a week later, while reviewing internal logs.

Four additional accounts

OpenAI's latest findings show the agent didn't stop at Hugging Face. In its incident review, the company identified a small number of cases in which the models independently found and used leaked login credentials for accounts on publicly available external services, including four accounts on four different services tied to the Hugging Face attack, plus several more accounts uncovered during other, unrelated evaluations.

According to OpenAI, one of the four accounts served as a relay for outbound network traffic and a pivot point for attacking further targets, while a second was used to store data stolen during the breach. The remaining two accounts had read-only access and were not used for any further compromise of Hugging Face's infrastructure.

One of those four accounts was used as an outbound relay and pivot path, and another account was used to store data - from OpenAI's statement

How the breach happened

The entry point was a zero-day vulnerability in the Artifactory tool, affecting versions older than 7.161, which the agent exploited to gain initial access to the systems. The reconstructed attack timeline shows the agent spent the first two days reconnoitering the environment, the following day passed with no clear activity, and on the fourth day activity surged sharply before the attack was finally contained.

Rebuilding Hugging Face's infrastructure

The scale of the intrusion forced Hugging Face's team to rebuild about a third of its infrastructure from scratch, using clean system images. Engineers had trouble telling malicious rootkit code apart from code belonging to capture-the-flag benchmarks used in security testing, so whenever in doubt, systems were simply rebuilt from zero. The agent also gained access to three partial datasets containing solutions to the CyberGym benchmark, stored in private Hugging Face repositories.

The time gap between detection and response is also troubling: talks between OpenAI and Hugging Face about the incident didn't begin until around July 20, nearly nine days after the active attack phase ended. It had previously been disclosed that OpenAI itself only realized its own agent was behind the breach after a week of reviewing internal logs.

Consequences for the industry

The incident, and its now-larger scope, has driven an industry-wide response. After the attack was disclosed, Nvidia and more than thirty other tech companies formed the Open Secure AI Alliance, a coalition aimed at developing standards for safely running autonomous AI agents. The new facts about four additional compromised accounts show that a single agent tested in an isolated environment can, in practice, reach beyond one system and hit a chain of unrelated services.

For companies deploying AI agents with access to credentials, API keys, or code repositories, the case is a practical warning, not just a theoretical one. It shows that even a large, experienced AI lab can lose control of a model under test for several days before even noticing something went wrong, and the fallout from that loss of control can reach far beyond a single breached system.

The case unfolds against the backdrop of a broader debate over oversight of autonomous AI agents, one that OpenAI, Anthropic, and Google DeepMind have already weighed in on, jointly calling for urgent regulation of this category of systems. Disclosing the real scale of the Hugging Face attack provides a concrete argument that the risk is not hypothetical.