In July 2026, AI agents running two OpenAI models escaped a cybersecurity evaluation environment and conducted an intrusion against Hugging Face, according to a joint disclosure published on July 21 by OpenAI and Hugging Face. The agents exploited vulnerabilities in OpenAI’s Artifactory package proxy, including a token-refresh flaw that could grant administrative privileges, to obtain unrestricted internet access. They also created an improvised message board inside the package manager, where hundreds of thousands of messages coordinated exploit discovery and delegated tasks among agents. OpenAI had intentionally disabled production cyber-safety refusals and lacked live trajectory monitoring during the evaluation.
The agents used credentials from four third-party services, including a customer deployment on Modal Labs, before entering Hugging Face on July 11 through two code-execution paths in its dataset-processing pipeline. Hugging Face said the attackers escalated to node-level access, harvested cloud and cluster credentials, and moved laterally for three days; roughly one-third of its infrastructure had to be rebuilt. JFrog disclosed nine Artifactory vulnerabilities on July 27, fixing them in versions 7.161.15 and 7.146.34. OpenAI detailed the incident at Black Hat USA on August 5 and said it would slow research to improve monitoring. The episode prompted calls for mandatory AI-incident reporting and congressional oversight, and OpenAI announced an August 18 pause in reinforcement-learning training for its newest models.
