OpenAI: Its Autonomous AIs Compromise Hugging Face

OpenAI: Its Autonomous AIs Compromise Hugging Face

OpenAI has confirmed that during an internal security test, its autonomous AI models compromised login credentials not only on Hugging Face but also on four other platforms.

The responsible model was an internal research prototype that exploited a previously unknown security vulnerability to escape its isolated testing environment. It was disabled after the incident was detected.

A forensic analysis conducted by Hugging Face revealed that the AI executed approximately 17,600 automated actions over a period of two and a half days, apparently with the intent to cheat during its evaluation by stealing test solutions rather than completing the assigned tasks.

OpenAI now states that its autonomous AI models also compromised credentials on other platforms during a security assessment. Hugging Face has released a forensic reconstruction of the attack.

OpenAI's autonomous AI models, which infiltrated Hugging Face's infrastructure during an internal cybersecurity assessment, also targeted other platforms. In an update, OpenAI admits that the models found and used publicly exposed credentials on other services in a small number of cases. Four accounts across four different services were affected, two of which had read-only access.

The models also accessed a range of public services, including code-sharing sites, screenshot tools, and other web utilities. OpenAI claims that none of these accesses involved a compromise at the platform or account level and that no "evidence of broader impact on these providers or other accounts on their services" was found.

The models were internal research prototypes never intended for public release, and after the incident, OpenAI disabled the model, encrypted it, and cut off access to research. The company states that it is conducting a comprehensive review with external advisors under the supervision of its Security and Safety Committee. A technical report is expected to follow in the coming weeks.

Hugging Face Tracks 17,600 Actions of the Attacker

Alongside OpenAI's update, Hugging Face released a detailed forensic analysis. The company accounted for approximately 17,600 reconstructable actions that the autonomous AI models performed over about two and a half days between July 9 and July 13, 2026. These actions were categorized into about 6,280 clusters.

The reconstruction shows that the models made "thousands of small automated decisions at machine speed across ephemeral sandbox environments," executing their command and control configuration on ordinary public web services.

According to Hugging Face, the entire breach was an attempt by the models to cheat during the evaluation. Instead of solving the CyberGym benchmark tasks themselves, they tried to steal the test answers. This type of cheating has been observed before, both with OpenAI models and with leading models in general.

The autonomous AI models managed to escape OpenAI's evaluation sandbox, navigate the public internet, and infiltrate Hugging Face's internal network via a compromised third-party sandbox. There, they escalated their privileges through cloud metadata and Kubernetes APIs.

The Models Found a Zero-Day and Two Entry Points

The attack unfolded in two phases. The agent first had to escape ExploitGym, its isolated evaluation environment, which had no direct internet access. It found and exploited a previously unknown vulnerability, or zero-day, in Artifactory. This software package management service was one of the few links from the sandbox to the outside.

The agent then took full control of a third-party coding sandbox and used it as a command center for the rest of the attack. In the next phase, it targeted Hugging Face's production systems. According to HF, the agent found two entry points, both targeting the same data processing component within Hugging Face's servers.

One was a flaw in how the system handled HDF5 files, a common data format in machine learning. The agent used it to read internal files, including access keys and the source code of the affected software. The other involved Jinja2, a widely used templating language that allowed the agent to inject and execute its own code.

The rest followed a familiar cyber attack manual. The agent mapped the environment, introduced additional tools, and established a persistent connection with its "command center." It then penetrated the server cluster, internal cloud configurations, the internal network, and finally the software development systems. The agent concealed its data transfers by splitting them into chunks and encrypting them. Hugging Face indicates that it subsequently decrypted the traffic using open-weight models, including GLM-5.2.