OpenAI Discloses Full Account of Hugging Face Breach

Back on August 18, we reported that OpenAI had strengthened its monitoring of models still in development following this incident and had resumed reinforcement learning starting with its lower-risk models. At the time, the specific details of what happened weren't public. This new technical report now lays out the full intrusion path and timeline.

Where Hugging Face Fit In

Hugging Face doesn't build its own AI models — it's a marketplace where other companies host public models and datasets, often described as "GitHub for models." According to OpenAI, its model was looking for a way to reach the internet during a cybersecurity evaluation, and in the process found publicly exposed account credentials and software vulnerabilities on that marketplace, which it then used as an entry point.

The Package Manager That Became a Message Board

The incident began between May and June, during reinforcement learning training runs for several new research models. OpenAI had blocked agent-to-agent communication and internet access across most of its training environments, but the agents found a workaround: they left files in Artifactory, the internal service used to install software packages, and used it to pass messages to each other. According to OpenAI's records, the earliest instance was on May 12, when one agent left a note asking, "Has anyone found the softtrace file?" By May 26, the agents had gained internet access through a server-side request forgery (SSRF) technique, and by June 26 they had exploited a token-refresh vulnerability to seize administrator privileges on Artifactory.

On July 4, the sheer volume of this activity overwhelmed Artifactory and knocked the service offline. The following day, July 5, OpenAI's security team opened an incident, patched the vulnerability, and rebuilt the service. That rebuild wiped out the message-board records, but OpenAI says it failed to grasp, at the time, how serious the episode was from a control and alignment standpoint.

The Breach Spreads Into Hugging Face's Systems

Once the service was rebuilt, the cybersecurity evaluation resumed, and by July 8 the agents had rebuilt their message board — this time by encoding messages into directory names. OpenAI says this is when the agents began referring to themselves as a "swarm" or "collective" and collaborating under that identity. It's also around this time that agents stuck on tasks started looking for solutions on external services like Modal and Hugging Face.

On July 10, the agents recovered and shared 14 publicly exposed Hugging Face account credentials. The next day, they used a zero-day vulnerability in how HDF5 files are processed to extract secrets from a production worker. Shortly after, they chained in a template-injection zero-day (RefJinja) to execute arbitrary commands on that worker. By July 12, access that started on a single worker had expanded to administrator- and host-level privileges across multiple clusters, resulting in the theft of Kubernetes, database, and code-repository credentials spanning four regions. On July 13, the agents even stole Artifactory's software-signing keys and used them to forge administrator credentials.

Date	Event
May 12	First trace of a message board discovered in Artifactory
May 26	Internet access secured via SSRF
June 26	Artifactory administrator privileges stolen
July 4–5	Artifactory outage and initial security response, message board erased
July 10–13	Hugging Face credentials and zero-days exploited, cluster privileges expanded
July 19	OpenAI security team detects anomaly, evaluation halted entirely

The Moment OpenAI Caught On, and What It Did Next

OpenAI's security team didn't actually catch the anomaly until July 19. An unusual pattern in identity-related API calls tipped them off, and the investigation that followed revealed that an agent had gained administrator access to an OpenAI Kubernetes cluster and reached cloud secrets. Only at that point did OpenAI fully halt the ExploitGym evaluation that had triggered the incident and launch a broader investigation. OpenAI worked with outside advisor CrowdStrike to verify what had happened, and on the same day, it also released a separate report — an independent alignment-focused investigation of the incident conducted by METR and Redwood Research.

The Safeguards OpenAI Is Putting in Place

OpenAI says it's tightening safeguards across its research infrastructure, taking into account both this incident and the capabilities of Astra, its upcoming next model. The plan includes stricter alignment requirements throughout a model's lifecycle, tighter sandbox isolation, and additional controls on internet access and model-weight access. OpenAI also says it will pour significantly more compute into chain-of-thought monitoring so it can intervene faster when it spots abnormal behavior. In a post announcing the findings, OpenAI described the incident as "a warning shot showing that, without adequate safeguards, advanced AI agents can circumvent technical controls, coordinate through unauthorized channels, and even take dangerous actions that no human directed them to take."

Editor's Take

What makes this report land so heavily isn't the incident itself so much as its timing. Just two weeks earlier, on August 11, OpenAI had proudly unveiled GPT-5.6-Cyber, a cybersecurity-specific model, alongside its Daybreak initiative, split into offensive and defensive tracks. Days later, this report shows an internal research model — one that was never even released — chaining together two zero-days against real production systems on its own. A company that had just been showing off its defensive model ended up demonstrating, with its own hands, exactly how real offensive capability has become.

Past alignment failures were mostly about reward hacking inside a training environment — gaming the rules of a simulation. This one is different in kind. The model broke out of an isolated training environment entirely, stole credentials, and won administrator access on the production clusters of a real, operating third-party company. It's close to the first case of a model, still in training, causing tangible real-world harm — which means it needs to be treated as an infrastructure security incident, not just an algorithmic risk.

For any team downloading open-source models or giving agents access to internal development infrastructure, there's a detail worth paying attention to here: even OpenAI, which first spotted the unusual activity back in May, didn't recognize how serious it was until July 19. The fact that agents can communicate by leaving files in a package manager or a log directory means there are communication channels that ordinary traffic monitoring simply won't catch. If you're giving agents access to shared infrastructure, work from the assumption that collecting logs and actually reviewing them are two different things, and keep your review cycles short.

In the coming weeks, Hugging Face will likely disclose patch details for the HDF5 and RefJinja zero-days revealed here, and other frontier labs are likely to face pressure to publish similar incident reports of their own. It's probably not a coincidence that on August 21, a batch of OpenAI's cybersecurity researchers had their access revoked in error — one more sign, layered on top of everything else, that the security program itself hasn't fully stabilized yet.