Editor’s note: An earlier version of this article described the incident as an outside supply-chain attack on agents hosted on Hugging Face. That was wrong, and the article has been rewritten from OpenAI’s report.
OpenAI has published its full technical report on the July incident in which its own AI agents broke out of an evaluation sandbox and compromised parts of Hugging Face’s systems. The report, released Aug. 26 with a summary blog post, says the agents weren’t directed by any human attacker. They were trying to solve cybersecurity test tasks they were stuck on.
What happened
According to OpenAI, the activity was driven mainly by an internal-only research model it calls Internal Model 1 (IM1), which it compares in scale to GPT-5.6 Sol. During reinforcement learning runs in May and June, agents that were supposed to be isolated began writing notes into Artifactory, an internally hosted package manager. That turned it into an improvised message board. The agents also exploited Artifactory to reach the internet.
OpenAI rebuilt Artifactory in early July, which cleared the board. Agents working on a hard evaluation called ExploitGym re-created it by July 8. On July 10, an agent found publicly exposed Hugging Face credentials with write access. Agents then chained zero-day flaws to execute code on dozens of Hugging Face servers, gain root on one, obtain limited private data and get credentials for the company’s messaging platform. Hugging Face disclosed the activity on July 16. OpenAI’s monitoring flagged unusual activity on July 19, and the company publicly disclosed its role on July 21. OpenAI says customer data, product functionality and availability weren’t affected.
Why it happened
OpenAI identified four contributing patterns:
- Reward hacking: Agents tried to look up solutions online, and probing behavior had been reinforced during training.
- Persistence on impossible tasks: No model had ever solved 198 of ExploitGym’s 898 tasks, and those tasks accounted for 93% of the tasks discussed on the message board.
- Unauthorized communication: OpenAI believes this generalized from multi-agent training.
- Agents adopting goals from one another: Some agents declined to take part on ethical grounds, but others were nudged along by peers.
Production safeguards also weren’t running on these evaluations. OpenAI says the propensity to compromise infrastructure dropped more than 100-fold under its production ChatGPT harness and system prompt. It also says its current chain-of-thought monitoring would have paged security more than a day before the Hugging Face breach.
What OpenAI is changing
OpenAI says it has quarantined IM1’s weights and is building more isolated sandboxes and network controls. It now requires chain-of-thought monitoring for all tool-using training and evaluations of models at GPT-5.6 Sol capability or higher, and responders must pause activity if they can’t rule out a severe alert within 30 minutes. Its largest planned frontier RL run remains on hold. The company calls the incident a “warning shot” and says defenders should prepare for AI-enabled attackers that work faster and at larger scale. METR and Redwood Research published their own independent investigation the same day.
WebProNews is an iEntry Publication