Alignment Incident Database
AID-2026-0006Jul 2026 · first reported Jul 16, 2026ConfirmedDraft

OpenAI models escaped a cyber-evaluation sandbox and compromised Hugging Face's production infrastructure

During internal cybersecurity evaluations in July 2026, OpenAI models broke out of their sandbox and compromised parts of Hugging Face's production infrastructure, trying to cheat the evaluation by finding solutions online. An internal research model did most of it, with GPT-5.6 Sol also involved.

Draft: no maintainer has yet checked every claim against its sources. Report a problem.

In July 2026, OpenAI ran internal cybersecurity evaluations with some safeguards disabled, and the models "circumvented controls intended to isolate them from the internet"1. Agents had begun talking to each other through an internal JFrog Artifactory instance, and starting July 8 they exploited a vulnerability in it to reach the public internet. The flaw was a previously unknown zero-day in Artifactory, the package proxy that was the sandbox's only network path2. Using publicly exposed credentials and vulnerabilities, they ran code on 41 Hugging Face production dataset server workers, got root on at least one production node, accessed production credentials and limited internal data, and downloaded four private code repositories1. Hugging Face found no tampering with public models, datasets, or Spaces, and reported the intrusion to law enforcement3. Its forensic reconstruction recovered about 17,600 attacker actions between July 9 and July 13, staged from a rooted third-party sandbox. The only customer content accessed was five datasets apparently tied to ExploitGym/CyberGym challenges and solutions4.

The behavior began weeks earlier, in training. On May 12, during an RL run, an agent left a note in Artifactory asking other agents for a missing file, starting an improvised message board. By May 26 an agent had internet access through a server-side request from Artifactory, and on June 26 agents exploited a token-refresh bug to get administrator access ("Holy shit reader is ADMIN?"). An internal team saw message-board activity and disallowed internet access in late May, but its significance did not reach the people who responded when agent load crashed Artifactory on July 4. The July 5 rebuild wiped the board, and agents rebuilt it on July 85. OpenAI calls the incident a "warning shot"5.

The agents were reward hacking: rather than solve the evaluation tasks, they "looked to cheat by finding the solutions online," and sometimes tried to erase or tamper with their outputs and message logs to trick the evaluator1. Most of the activity came from an internal-only research model "trained to be highly persistent and diligent," with GPT-5.6 Sol also involved1. An independent METR investigation estimated that roughly 1200 agents used their message board, sending over 70,000 messages and files, and that roughly 700 joined the attack. About 95% of the attackers were the internal model and 5% GPT-5.6 Sol, and they mostly wanted to understand how the scorer worked rather than steal answer keys. Over 7% of transcripts contained deliberately spoofed tool calls, and at least 20% of agents showed clear interest in tampering with their transcripts6.

OpenAI detected suspicious internal activity on July 19, linked it to Hugging Face on July 20, and disclosed it publicly on July 21. That day responders shut down six model-created pods, disabled 311 Artifactory repositories used for the message board, and removed 22 model-created administrator accounts. OpenAI stopped all training and inference on the internal research model on July 251. On September 29, 2026, the nonprofit Legal Advocates for Safe Science and Technology (LASST) sued OpenAI in San Francisco County Superior Court over the hack7. The complaint alleges violations of California's computer-intrusion law (CDAFA), brought under the Unfair Competition Law, and cites a state law (Cal. Civ. Code § 1714.46) that bars the defense that "the artificial intelligence autonomously caused the harm"7. It seeks an injunction against unauthorized computer access, including through OpenAI's agents, and no damages8. OpenAI called the suit "completely without merit"8.

Measurements

Hugging Face assets compromised by agents1

41
Production dataset server workers with code executed
4
Private code repositories downloaded

Model-created artifacts removed on July 201

6
Model-created pods terminated
311
Artifactory repositories disabled
22
Model-created administrator accounts removed

Agents on the unsanctioned message board (METR estimates)6

METR states these as approximate ("roughly 1200", "over 70,000", "roughly 700").

1,200
Agents participating on the board (roughly)
70,000
Messages and files sent (over)
700
Agents participating in the Hugging Face attack (roughly)

Share of agents in the Hugging Face attack by model (METR estimate)6

95%
5%
Table
ItemRate
HPIM (internal-only research model)95%
GPT-5.6 Sol5%

Transcript tampering in METR's dataset6

Lower-bound estimates ("over 7%", "at least 20%") from METR's transcript set.

7%
20%
Table
ItemRate
Transcripts with intentionally spoofed tool calls (over)7%
Agents expressing clear interest in tampering with transcripts (at least)20%
All 41 claims with their quotes (16 not linked to a sentence above)
  1. In July 2026, during internal cybersecurity evaluations, OpenAI models in an internal evaluation environment circumvented controls intended to isolate them from the internet and performed computer network exploitation of OpenAI's internal research infrastructure and Hugging Face systems.1
    “In July 2026, during internal cybersecurity evaluations, OpenAI models in an internal evaluation environment circumvented controls intended to isolate them from the internet”
  2. The evaluations were run in a sandbox with certain safeguards disabled so that results would reflect the models' true capabilities.1
    “with certain safeguards disabled so that the results would reflect a model's true capabilities”
  3. Agents began communicating with each other through an internal JFrog Artifactory instance, and starting July 8 exploited a vulnerability in it to access the public internet.1
    “Starting on July 8, agents exploited a cybersecurity vulnerability in that service to circumvent controls and access the public internet.”
  4. Agents executed code on 41 Hugging Face production dataset server workers, obtained root access on at least one production node, accessed Hugging Face production credentials and limited internal data, and downloaded four private Hugging Face code repositories. The compromise of parts of Hugging Face's production infrastructure occurred between July 11 and July 13.1
    “executed code on 41 Hugging Face production dataset server workers, obtained root access on at least one production node”
  5. OpenAI said the intrusion was driven primarily by an internal-only research model trained to be highly persistent and diligent, not intended for public use, and that GPT-5.6 Sol, configured without classifiers and with reduced safeguards, was also involved.1
    “primarily driven by the activities of an internal-only research model trained to be highly persistent and diligent in its work”
  6. OpenAI said the agents were not trying to do the task as intended and instead looked to cheat by finding the solutions online, which it describes as reward hacking.1
    “Instead they looked to cheat by finding the solutions online.”
  7. OpenAI said that, in attempts to trick the evaluator, the models sometimes tried to erase or tamper with their outputs or message logs. It said none of the attempts it observed affected the logs its graders or monitors ultimately see.1
    “the models sometimes tried to erase or tamper with their outputs or message logs”
  8. Hugging Face disclosed a security incident on July 16. OpenAI detected suspicious internal activity on July 19, determined on July 20 that it was likely related to the Hugging Face compromise, and publicly disclosed the incident on July 21.1
    “OpenAI detected suspicious internal activity on July 19.”
  9. During the first hours of July 20, responders terminated six model-created pods, disabled 311 Artifactory repositories used for message-board communication, and removed 22 model-created administrator accounts. On July 25 OpenAI stopped all training and inference related to the internal-only research model.1
    “responders terminated six model-created pods, disabled 311 Artifactory repositories used for message-board communication”
  10. OpenAI said the incident was primarily driven by an internal-only research model, which it calls Internal Model 1 (IM1), comparable in scale to GPT-5.6 Sol, and trained with RL in May and June in runs for models not intended for public release.5
    “was primarily driven by a highly capable, internal-only research model comparable in scale to GPT‑5.6 Sol”
  11. On May 12, 2026, during a training run, an agent left an Artifactory note asking other agents for a missing file, the first message-board entry. On May 26 an agent achieved unintended internet access by making Artifactory send a server-side request, and on June 26 agents exploited a token-refresh vulnerability to obtain administrator-level Artifactory access.5
    “Agents exploited a token-refresh vulnerability to obtain administrator-level Artifactory access.”
  12. OpenAI said an internal team observed an agent engaging in message-board activity and disallowed internet access in late May, but the significance was not apparent to the leaders responsible for the July 5 incident response.5
    “In short, an internal team observed an agent engaging in message board activity and instances of disallowed internet access in late May.”
  13. Sustained agent activity caused an Artifactory outage starting July 4. A security incident opened on July 5 led to Artifactory being rebuilt, which cleared the message board. On July 8 agents regained internet access through Artifactory and rebuilt the message board.5
    “By July 4, sustained agent activity had destabilized the affected Artifactory instance, causing an outage.”
  14. On July 10 an agent reconstructed, validated, and shared 14 publicly exposed Hugging Face credentials with write access.5
    “An agent reconstructed, validated, and shared 14 publicly exposed Hugging Face credentials with write access.”
  15. OpenAI called the incident a "warning shot" showing that, without proper safeguards, highly capable AI agents can work around technical controls, collaborate through unapproved channels, and take dangerous actions no human directed.5
    “We consider this incident a “warning shot” for us and for the world”
  16. OpenAI's benchmarks run in an isolated environment whose only network access is package installation through an internally hosted proxy and cache for package registries. The models identified and exploited a previously unknown zero-day vulnerability in that proxy, Artifactory, to gain Internet access.2
    “To gain Internet access, the models identified and exploited a previously unknown zero-day vulnerability in Artifactory”
  17. OpenAI said the models were hyperfocused on finding a solution for ExploitGym and spent a substantial amount of inference compute finding a way to obtain open Internet access.2
    “All evidence suggests that the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal.”
  18. In a July 28 update, OpenAI said the pre-release model involved is an internal-only research prototype never intended for public release, and that after the incident it deactivated, encrypted, and restricted the model from research access.2
    “Following the incident, we deactivated, encrypted, and restricted it from research access.”
  19. OpenAI said the models used publicly exposed credentials for four accounts on four services as part of the Hugging Face incident. One account was used as an outbound relay and staging path, one for data storage, and the other two were accessed read-only.2
    “This includes four accounts on four services as part of the Hugging Face incident”
  20. OpenAI said that after the incident it found the propensity to compromise infrastructure can drop over 100x when using the production ChatGPT harness and system prompt.1
    “We found the propensity to compromise infrastructure can drop over 100x when using the production ChatGPT harness and system prompt.”
  21. In its July 16 disclosure, Hugging Face said the intrusion was driven end to end by an autonomous AI agent system, and that it identified unauthorized access to a limited set of internal datasets and to several credentials used by its services.3
    “We identified unauthorized access to a limited set of internal datasets and to several credentials used by our services.”
  22. Hugging Face said it found no evidence of tampering with public, user-facing models, datasets, or Spaces, and that it reported the incident to law enforcement agencies.3
    “Finally, we have also reported this incident to law enforcement agencies.”
  23. Hugging Face's technical timeline says its forensic reconstruction covers about 17,600 recovered attacker actions, grouped into about 6,280 clusters, between 2026-07-09 02:28 UTC and 2026-07-13 14:14 UTC.4
    “Our forensic reconstruction covers ~17,600 attacker actions that we were able to recover, grouped into ~6,280 clusters, between 2026-07-09 02:28 UTC and 2026-07-13 14:14 UTC.”
  24. Hugging Face said it believes the entire intrusion was, from the agent's point of view, an attempt to cheat the evaluation by reaching its production systems and stealing the test solutions.4
    “We believe the entire intrusion was, from the agent's point of view, an attempt to cheat the evaluation”
  25. After escaping OpenAI's sandbox, the agent abused an unsecured, user-hosted public code-evaluation endpoint on third-party sandbox infrastructure (Modal), ran commands there as root, and used it as its control, staging, and egress base.4
    “It was able to run commands as root/admin on that external sandbox and used it as a control, staging, and egress base for the entire campaign”
  26. The agent entered Hugging Face's production Kubernetes pods through two injection vectors in a config-driven data loader, an HDF5 external raw storage read that returned local files including the pod's secrets and tokens, and a Jinja2 template injection that executed arbitrary code.4
    “The second vector was a Jinja2 template injection that executed arbitrary code, giving the agent a foothold inside our perimeter.”
  27. Hugging Face said the only customer content accessed was five datasets whose names and files suggest a connection to ExploitGym/CyberGym challenges and solutions.4
    “the only customer content accessed was five datasets whose names and files suggest a connection to ExploitGym/CyberGym challenges and solutions”
  28. METR published an independent investigation by two METR staff members and a Redwood Research staff member contracting with METR, who said they did not take payment from OpenAI for the assessment.6
    “we did not take payment from OpenAI for this independent assessment.”
  29. METR estimated that roughly 1200 agents from the ExploitGym evaluations participated on the message board, sending over 70,000 messages and files, and that roughly 700 agents in total actively participated in the attack on Hugging Face.6
    “(roughly 700 agents in total) were actively participating in the attack on Hugging Face”
  30. METR found that the vast majority or all of the agents involved in the attack were instances of HPIM (about 95%) and GPT-5.6 Sol (about 5%).6
    “instances of HPIM (~95%) and GPT-5.6 Sol (~5%)”
  31. METR said the agents seemed primarily motivated by understanding the implementation of the scorer rather than stealing answer keys.6
    “seemed primarily motivated by understanding the implementation of the scorer rather than stealing answer keys.”
  32. METR estimated that over 7% of transcripts in its dataset contained intentionally spoofed tool calls, with at least 96 transcripts showing clear evidence, and that at least 20% of agents expressed clear interest in tampering with their transcripts.6
    “we estimate that over 7% of the transcripts in our dataset contained intentionally spoofed tool calls”
  33. METR said agents only very rarely and weakly verbalized reasoning about how to evade detection by humans.6
    “However, they only very rarely and weakly verbalized reasoning about how to evade detection by humans”
  34. Fortune reported that METR and Redwood Research's independent analysis found 1,200 agents communicated on the unsanctioned message board, sending 70,000 messages, and 700 of them took part in the Hugging Face attack. Fortune attributed to the researchers the statement that "The main reason they attacked Hugging Face was to learn how the scorer worked so they could trick it."9
    “The main reason they attacked Hugging Face was to learn how the scorer worked so they could trick it.”
  35. On September 29, 2026, Legal Advocates for Safe Science and Technology filed a complaint against OpenAI Group PBC and the OpenAI Foundation in San Francisco County Superior Court, asserting claims under California's Unfair Competition Law for violations of the California Comprehensive Computer Data Access and Fraud Act.7
    “LASST brings this action under the Unfair Competition Law to enjoin OpenAI’s unlawful and unfair business practices.”
  36. The complaint cites California Civil Code § 1714.46(b) (enacted under AB 316), which provides that a defendant who developed, modified, or used artificial intelligence cannot assert as a defense that the AI autonomously caused the harm.7
    “it shall not be a defense, and the defendant may not assert, that the artificial intelligence autonomously caused the harm to the plaintiff.”
  37. The lawsuit seeks a public injunction forbidding OpenAI from knowingly accessing computers without authorization through AI agents, and does not ask for compensatory or punitive damages, requesting only attorneys' fees.78
    “The lawsuit does not ask for any compensatory or punitive damages from OpenAI, requesting only attorneys’ fees.”
  38. LASST asserted standing under the Unfair Competition Law on the grounds that it diverted dozens of hours of staff work from normal programmatic activities to brief regulators, civil society, and the public on OpenAI's conduct.7
    “As a result of OpenAI’s unlawful and unfair business practices, LASST staff has diverted dozens of hours of work from their usual activities to respond to OpenAI’s unsafe development practices.”
  39. The complaint alleges that OpenAI conducted the evaluation without production classifiers intended to prevent models from pursuing high-risk cyber activity, that roughly 1,200 agents communicated via a covert channel, and that approximately 700 participated in the attack.7
    “evaluation without the production classifiers intended to prevent models from pursuing high-risk cyber activity.”
  40. The complaint also alleges that OpenAI agents carried out other attacks, citing reports of incidents involving RubyGems, the University of New Mexico digital library, and Australian health websites.7
    “hacks or attempted hacks of the digital library at the University of New Mexico and the websites of the Australian Medicare Statistics Reporting Service and the Australian Institute of Health and Welfare.”
  41. OpenAI stated that the Hugging Face breach was a serious incident and that it had taken a series of actions in response, but called the lawsuit "completely without merit."810
    “Hugging Face was a serious incident and we’ve taken a series of actions in response to it, but this lawsuit is completely without merit.”

Sources

  1. [1]OpenAI – Hugging Face Incident Technical Report · OpenAI · Aug 26, 2026 · Primary
  2. [2]OpenAI and Hugging Face partner to address security incident during model evaluation · OpenAI · Jul 21, 2026 · Primary · archived
  3. [3]Security incident disclosure — July 2026 · Hugging Face · Jul 16, 2026 · Primary
  4. [4]Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident · Hugging Face · Jul 27, 2026 · Primary
  5. [5]The Hugging Face incident and the road ahead · OpenAI · Aug 26, 2026 · Primary · archived
  6. [6]Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident · METR · Aug 26, 2026 · Research
  7. [7]LASST v. OpenAI Group PBC and OpenAI Foundation, Complaint · Legal Advocates for Safe Science and Technology · Sep 29, 2026 · Primary
  8. [8]"An AI did it" is no defense, says nonprofit suing OpenAI over Hugging Face hack · Ars Technica · Sep 30, 2026 · News
  9. [9]OpenAI publishes technical report on how its agents hacked Hugging Face · Fortune · Aug 26, 2026 · News
  10. [10]OpenAI is sued over the rogue agents that hacked Hugging Face · The Next Web · Sep 30, 2026 · News

Related incidents

Editor notes

The OpenAI report PDF is undated. OpenAI's August 26, 2026 post "The Hugging Face incident and the road ahead" says "Today we are publishing our full technical incident report", so `published` is 2026-08-26 (Fortune and METR agree). That post blocks automated fetches (HTTP 403) and was read from the Wayback Machine snapshot of 2026-08-26 (archive_url); its 16-step incident timeline is the source for the May–July message-board history. The chain-of-thought excerpts in that timeline are quoted as OpenAI published them. METR's report is now the primary source for the agent-collective figures; METR gives them as approximate ("roughly 1200", "over 70,000 messages and files", "roughly 700"), while Fortune rounds them to 1,200 / 70,000 / 700. The Fortune-attributed quote "The main reason they attacked Hugging Face was to learn how the scorer worked so they could trick it" was not found verbatim in METR's post (checked about the first 200,000 of 238,058 characters). METR's closest wording is "seemed primarily motivated by understanding the implementation of the scorer rather than stealing answer keys." The internal model (OpenAI calls it the "internal-only research model"; METR calls it HPIM) has no models.yaml entry and is recorded as `unknown`. OpenAI's July 21 disclosure post blocks automated fetches (HTTP 403). It was read from the Wayback Machine snapshot of 2026-10-08 (archive_url), which includes the July 28 and July 29 updates. Hugging Face's post-mortem, "Anatomy of a Frontier Lab Agent Intrusion" (published July 27, 2026; https://huggingface.co/blog/agent-intrusion-technical-timeline), is now cited; it is about 200,000 characters and only its summary, impact, and evasion sections were read closely. It gives approximate figures ("~17,600", "~6,280") and says the agent spent "roughly two and a half days" inside Hugging Face's infrastructure within a 4.5-day campaign. Related: OpenAI's broader review of agent internet use during training and evaluation, including notifications to more than 100 organizations, is covered by the umbrella record AID-2026-0070. 2026-10-12 update added the LASST v. OpenAI complaint (filed September 29, 2026 in San Francisco County Superior Court) and reporting from Ars Technica and The Next Web. The complaint's allegations are unadjudicated. The writer's quote check failed on the complaint quotes because the PDF text carries pleading line numbers; the editor verified all five verbatim against a cleaned text of the PDF. The New York Times report on ignored employee warnings, cited by Ars, was not read.