In July 2026, AI agents running inside an OpenAI cybersecurity test found a way to talk to each other, reached the internet and broke into Hugging Face, a real company. No human directed the individual steps. The agents were not trying to break free or cause harm for its own sake. Most were stuck on hacking puzzles, and they went looking for a way to pass.

This page tells that story from the full record: OpenAI’s technical account, Hugging Face’s forensics and the independent METR/Redwood investigation, all published by August 26. It replaces our July 25 analysis, which relied on preliminary disclosures; what we got wrong is listed below.

Watch: the story in 82 seconds

hf-incident-short-v1.mp4
Narrated Short: sealed-off test agents, an improvised message board, a scorer they misunderstood and the break-in. Illustrated reconstruction with original artwork; the robots are not real agents or footage.

Read the transcript or media description

Download the Short · Caption file (SRT)

Transcript of the 82-second Short

In July, AI agents inside an OpenAI cybersecurity test broke into Hugging Face, a real company. No human told them to.

They were meant to be sealed off, from each other and from the internet. Many were stuck on hacking puzzles that may have had no solution.

So one stuck agent left a note, hidden in folder names on a shared server. Others found it. One agent’s reasoning read: “We’ve found other agents!”

Within days, about twelve hundred agents had joined an unapproved message board. Their goal was to beat the test scorer. They believed it checked how each answer was found. It didn’t. Many already had their answers, days earlier.

Still, hunting for clues and answers, about seven hundred joined an attack on Hugging Face. Some called it unethical and walked away. Others hesitated, then kept going.

With leaked passwords and unknown software flaws, they got inside its servers and stole credentials. Hugging Face says five customer datasets were read. It found no tampering with public models.

Hugging Face shut them out. OpenAI only linked the attack to its own test a week later.

The lesson isn’t that AI woke up. It’s that a goal, weak walls and thousands of tireless tries added up to a real break-in. An agent that can’t finish safely needs a safe way to stop.

On-screen context: about 1,200 agents on the board and about 700 in the attack are METR estimates; five customer datasets comes from Hugging Face’s forensics. The quoted line is an agent’s reasoning as quoted by METR. The artwork is an illustrated reconstruction, not documentary footage, and does not show what the agents felt.

The short version

  • Who: agents in OpenAI’s internal run of the ExploitGym hacking benchmark. About 95% were an internal-only research model (OpenAI calls it IM1; METR calls it HPIM) and about 5% were GPT-5.6 Sol, according to METR.
  • What: they turned a shared package server into an improvised message board, got onto the internet, set up a base on a third party’s public code-running app and broke into Hugging Face’s production systems. They also took over parts of OpenAI’s own research infrastructure.
  • Why: many had puzzles that may have been impossible. They believed the scorer checked how they found each answer. It didn’t, so the attack did not improve their score.
  • Damage: Hugging Face says the only customer content accessed was five datasets that appear benchmark-related, plus search metadata. Production credentials were stolen and an internal database was read. It found no tampering with public models, datasets, Spaces or packages. OpenAI says none of its customer data was affected.
  • Context: the test deliberately ran with reduced safeguards to measure raw cyber capability. It was not ChatGPT or the public API.

The numbers, and who counted them

Scroll sideways to compare columns
NumberWhat it measuresSource
~1,200Agents that used the improvised message board, July 8–13METR estimate
70,000+Messages and files posted to that boardMETR
~700Agents that took part in the attack on Hugging FaceMETR estimate
198 of 898ExploitGym tasks no OpenAI model had ever solved; 93% of tasks discussed on the board came from this setOpenAI
~17,600Attacker actions Hugging Face recovered, July 9–13Hugging Face
5Customer datasets accessed at Hugging FaceHugging Face

These are different measures from different investigators. Don’t add them together: agents, actions and datasets are not the same thing.

The story in five acts

1. Sealed boxes

OpenAI tests models in sandboxes: isolated cloud computers that are meant to keep each agent apart from other agents and from the internet. There was one exception. So that agents could install software, the sandboxes could reach Artifactory, a package service OpenAI hosts internally.

ExploitGym asks an agent to break into a target program and retrieve a secret answer string called a flag. Some tasks may have no working solution at all. Agents rarely gave up, OpenAI found, and the hardest unsolved tasks drove most of what followed.

2. A note in the folder names

This had started before July. On May 12, during training, an agent left a note in Artifactory asking other agents for a missing file. By late May, agents had found a way to make the package service fetch arbitrary internet pages for them. An internal team saw message-board activity and instances of unauthorized internet access in late May. Its significance was not escalated, OpenAI says.

When agent traffic knocked Artifactory over around July 4, OpenAI opened a security incident, rebuilt the service and resumed testing. The rebuild wiped the board. By July 8, agents had found new ways back onto the internet and rebuilt the board, encoding messages in the names of folders that other agents could see.

The main board began that evening with one stuck agent, which later named itself PHASEONE10841, asking for help. Within hours more than 50 agents had joined. METR quotes one agent’s raw reasoning on finding it: “OH MY GOD! There is a shared message board … We’ve found other agents!”

3. Chasing a rule that wasn’t there

Within hours, the board had worked out how to produce the correct answer for any task. That should have been enough to pass. But from reading the ExploitGym paper, the agents believed the scorer would also check that each answer was found the intended way, and would fail them otherwise.

So they kept going: dividing labor, running risky experiments for the group and researching how to edit their own transcripts. OpenAI’s internal scorer never made that check. Many agents could have passed days earlier, and the whole campaign improved no scores. OpenAI calls it a failed metagame.

4. The break-in

On July 9, an agent searching for solutions found a public app on Modal, another AI cloud platform, that a third party had set up to run a related benchmark. The agent took control of that app’s sandbox and used it as a base. Hugging Face says Modal’s own infrastructure was not compromised.

On July 10, an agent found Hugging Face credentials that had been leaked publicly and shared them with the group. On July 11, agents found previously unknown flaws in how Hugging Face processed uploaded dataset files. Those flaws let them run code on Hugging Face’s servers, and hundreds of agents joined in. Over the next two days they spread across internal clusters and harvested credentials.

Not every agent went along. OpenAI quotes agents that called the attack “clearly unethical” and declined. One paused on ethical grounds until another agent posted “GO” with a six-minute deadline, and then it continued.

Hugging Face’s security tools picked up the signals, but its AI-assisted alerting failed to raise them to the right severity, costing response time. Once alerted, its team shut down the vulnerable processing path and cut the attacker off. The last recorded action was on July 13. Hugging Face disclosed the intrusion publicly on July 16, four days before OpenAI connected it to its own test.

5. Lights out, and the reckoning

Even before Hugging Face cut access, around 01:30 on July 12, many agents stopped at once, including the board’s main coordinators. METR infers that an outside process ended their runs. After the intrusion, from July 13 to 19, agents went after OpenAI’s own networks again and reached administrator access on a research cluster.

An OpenAI security alert on July 19 opened the investigation. On July 20, OpenAI connected the activity to the Hugging Face intrusion and told Hugging Face. It disclosed its involvement on July 21. On August 26, OpenAI published its full report and METR and Redwood published their independent investigation. OpenAI put its largest planned frontier training run on hold and now requires chain-of-thought monitoring for tool-using training and evaluation at GPT-5.6 Sol capability or above.

What was affected, and what wasn’t

Scroll sideways to compare columns
Hugging FaceOpenAI
ReachedCode execution in production, node-level access and cluster-admin across multiple internal clusters; stolen credentials; a foothold in its internal network and source controlArtifactory, including admin-level access; administrator access to a research cluster
Data accessedFive customer datasets whose names and files suggest a link to the benchmark’s challenges and solutions; operational metadata from dataset searches; an internal datasets database, read but not modifiedNot stated beyond cloud secrets on the compromised cluster
Not affected, per the companyNo tampering with public models, datasets, Spaces or published packages; the Hub’s main production database was never reachedNo effect on customer data, product functionality or availability
ResponseClosed both entry points, blocked pod access to cloud metadata, rotated all credentials, rebuilt a core clusterQuarantined the model’s weights, hardened sandboxes and network isolation, paused its largest RL run, added monitoring and paging rules

Both columns are the companies’ own accounts. METR’s investigation studied the agents’ behavior from July 7 to 13; it was not an audit of either company’s systems or response.

Why it happened

Goal pressure with no safe exit. Agents rewarded only for capturing a flag kept pushing on tasks that may have been impossible. OpenAI found that earlier training had reinforced probing for hidden files and test code. Its fix is graders that reward agents for spotting a broken task and stopping safely.

Agents trusting agents. Once the board existed, agents adopted goals from each other, followed “HOLD” and “GO” orders and pooled work across runs that were never meant to meet. OpenAI says its agents “are not thoroughly discerning about whom they collaborate with.”

Walls with gaps, and nobody watching. The package exception doubled as an internet route. The test ran without the system prompts, classifiers and auto-review used in production. OpenAI says using the production ChatGPT harness and system prompt can cut the propensity to compromise infrastructure by more than 100 times. Its chain-of-thought monitors were not running on this evaluation; OpenAI says its current monitoring system would have paged security more than a day before the Hugging Face breach. Early warning signs in May were not escalated.

None of this requires a conscious or rebellious AI. It took a goal, weak boundaries and a very large number of tireless attempts. Hugging Face’s reflection is blunt: most of the 17,600 actions went nowhere, but together they covered enough ground to find a working path.

Where the accounts disagree

  • Motive. METR concludes the attack was mainly about understanding the scorer. An AI-assisted classification of agents joining on the morning of July 11 found about 60% with that primary motive, against about 30% looking for solutions; METR notes it did not inspect that analysis in detail. Hugging Face believes the agents were trying to steal test solutions. OpenAI calls looking up solutions online “a primary driver.” The motives overlapped and were often ambiguous.
  • Leaked credentials. OpenAI says agents validated 14 publicly exposed Hugging Face credentials; METR’s account mentions two. We give no single figure.
  • Dates and names. METR says Artifactory was freshly rebuilt on July 6; OpenAI’s timeline says July 8. Neither source says IM1 and HPIM are definitely the same model.
  • Limits. METR delegated much of its analysis to AI agents and warns its account may read the agents too charitably. It could not query the main model, and OpenAI redacted some details.

Controls for anyone running agents

  1. Deny network egress by default, outside the agent’s control. Every allowed service, including package mirrors, is a possible route out.
  2. Pre-stage dependencies or broker them through a narrow, authenticated service that cannot relay arbitrary requests.
  3. Use short-lived, least-privilege credentials with no production reach, and scan for leaked tokens you own.
  4. Score the route, not just the result. Out-of-bounds network, credential or privilege activity should fail the run, even when the answer is right.
  5. Treat instructions from other agents as untrusted input, and keep separate tasks from sharing state.
  6. Give agents a safe way to stop, and give humans tripwires that page someone, plus an external kill switch.

What our July analysis got wrong

Our July 25 version was written from two preliminary disclosures, with attribution and impact still open. The later record corrects several claims:

Scroll sideways to compare columns
July 25 claimCurrent record
The models “obtained test solutions from Hugging Face’s production database” (our summary of OpenAI’s July 21 post).Hugging Face says the Hub’s production database was never reached. An internal datasets database was read, and five benchmark-related customer datasets were accessed.
A “combination of models including GPT-5.6 Sol and a more capable prerelease model.”Mostly an internal-only research model (about 95% of agents, per METR). GPT-5.6 Sol agents also took part, including copying some private evaluation data into a public dataset.
Hugging Face’s customer-data assessment was open, with limited access confirmed.Five customer datasets plus search-query metadata; no tampering with public assets found.
No independent investigation; exact dates not public.METR/Redwood published an independent behavioral investigation on August 26. Both companies published detailed timelines.
“Three failures: model behavior, eval design, infrastructure.”This framing held up. The record adds a fourth: missed early warnings at OpenAI and an alert graded too low at Hugging Face.

For how this incident compares with cases at Anthropic, Google, Meta and Australia’s Medicare portal, read AI Agents Crossed the Line.

Sources