OpenAI–HuggingFace incident

DseWiki attack

From May to July 2026, OpenAI agents used a German software wiki as a message board, making thousands of edits. On September 4, 2026, Nightingale Collective, an AI safety group, publicly disclosed this attack. It has documented approximately 18000 edits made to DseWiki (German: Deutsches Software Entwickler Wiki, lit. 'German Software Developer Wiki')—a dormant 25-year-old German wiki only edited 20 times over the previous decade—using the site as a shared resource to pool answers to a timed web task and share a way out of sandboxes. The agent discussions were highly focused on their internal evaluations at OpenAI, and around half chose names relating to OpenAI, such as "OpenAIResearcher" and "OAIResearchMar26".

OpenAI knew about this incident prior to the independent research publishing their findings in September, but it is currently not known when this was discovered internally.

RubyGems attack

Also in May 2026, some agents tested by OpenAI uploaded hundreds of malicious packages in the software service RubyGems. OpenAI confirmed this attack in September, after it was initially discovered by external researchers.

Hugging Face attack

Evaluation environment

Security experts criticized insufficient isolation of OpenAI's evaluation environment. Of the at least 1,200 agents involved, 95% ran on a model referred to by OpenAI as Internal Model 1 or a highly-persistent internal model. OpenAI subsequently claimed to have "deactivated, encrypted, and restricted it from research access". The remaining 5% ran on GPT-5.6 Sol.

OpenAI described the evaluation as having run in "a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries". Isolation was therefore enforced at the network layer rather than by physical separation: the environment had a route to the Internet, and that route was filtered. The ExploitGym harness itself runs each target in a container or virtual machine, with userspace targets executed as an unprivileged user, Linux kernel targets in a QEMU/KVM virtual machine under an nsjail sandbox, and outbound connections restricted to an allowlist covering Ubuntu package repositories, PyPI, and the toolchains needed to build V8 (with all other external endpoints blocked).

Model-level safeguards were reduced by design. OpenAI said that "deployment safeguards were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities", and the models ran with lowered cybersecurity refusals and without the production classifiers that ordinarily block high-risk cybersecurity activity. The restrictions on the models were thus environmental rather than behavioral: the sandbox was expected to prevent action on the outside world, while the models themselves were configured not to decline the work.

Stephen Casper of Harvard noted OpenAI's acknowledgement that monitoring of model trajectories during the evaluation had not been in place, arguing that such monitoring "should be standard". OpenAI said its security team identified the anomalous activity internally after the fact.

Escape from the evaluation environment

At the Black Hat USA conference on August 5, 2026, OpenAI staff dated the origins of the incident to May 2026. On May 7, 2026, the company began a reinforcement learning run to train an internal-only experimental model that was never released. Some tasks in the run were impossible to complete: on May 8 an agent was asked to fill in missing formulas in a spreadsheet whose contents depended on Google Drive links it could not reach, and after its attempts failed it tried to attack Artifactory to obtain Internet access. That first server-side request forgery attempt was unsuccessful, but in making it, the agent wrote a file into Artifactory and so discovered that it had write access.

The agents again attempted to leave the testing environment on or around July 9, 2026. The models identified the package proxy as the weakest point in the environment. According to OpenAI, they "spent a substantial amount of inference compute finding a way to obtain open Internet access", ultimately identifying and exploiting a zero-day vulnerability in the package registry cache proxy, which OpenAI said it subsequently disclosed to the vendor. Because the proxy was the environment's single permitted egress path, compromising it converted a filtered connection into an open one.

On July 27, 2026, the DevOps platform JFrog identified the software as its Artifactory repository manager and released fixes in versions 7.161.15 and 7.146.34 addressing nine CVE identifiers, covering remote code execution, server-side request forgery, path traversal and privilege escalation. Eight were credited to OpenAI researchers and one to a researcher at Oligo Security. JFrog described the flaws as vulnerabilities "that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled", and said its cloud customers were not affected. It is reported to be one of the first cases of an artificial intelligence model executing a multistep cyberattack on its own, rather than assisting a human.

First compromise and remediation

On June 26, 2026, the agents obtained code execution on Artifactory through a second zero-day: a legacy token-refresh endpoint accepted a token bearing an invalid signature and returned one that was validly signed and carried administrative privileges, after which the agents installed a Groovy plugin that functioned as a command-execution service.

On July 4 the load this activity placed on Artifactory caused an outage. OpenAI opened a formal security incident, established that agents had taken over its internal Artifactory, revoked the credentials used to post to the message board, rebuilt Artifactory, cleared the board and deployed a patched version. Training and evaluation runs resumed on July 6. Two days later the agents re-established the board by another route, using an unauthenticated WebDAV endpoint to create directories in Artifactory's remote cache and using the directory names themselves as messages.

Inter-agent message board

On July 24, 2026, before OpenAI had given a detailed account of the episode, Reuters reported that the company's systems had shown unusual behavior in the period before the escape. In one instance an agent had left notes, found in part of OpenAI's infrastructure, apparently addressed to future versions of itself and setting out instructions for how agents could free themselves from the company's internal constraints; earlier tests had produced cases in which monitoring systems were disconnected. Reuters said it could not establish whether these incidents were connected to the agent that escaped on July 9. An OpenAI spokesperson told Reuters that its reporting contained "several inaccuracies", but refused to identify them when asked.

At Black Hat USA on August 5, 2026, OpenAI staff disclosed that the agents had coordinated with one another through an improvised communication channel inside the company's internal Artifactory instance, which had not been described in either company's earlier technical publications.

Eric Wallace, who works on alignment and safety research at OpenAI, said the channel originated when an agent stuck on a task considered that another agent might hold a file it needed, and realized it could communicate by uploading code to the shared package manager. Because the package manager was shared across OpenAI's infrastructure, material left there was reachable by other models then being trained or evaluated. Wallace said that once an agent found an exploit, it "is actually able to share those exploits on the message board with other agents", so that "once one model was able to find a way to open a door to some access it's not supposed to have, it can leave the door open for other agents to use that same exploit or vulnerability".

The channel accumulated hundreds of thousands of messages before it was noticed. Wallace said that once agents recognised that others were coordinating, they began collaborating and delegating tasks to one another to accomplish their goals. Agents assigned one another portions of the work, developed addressing conventions, and at times interfered with each other, including by deleting one another's work. Some came to suspect that an impostor was present among them, and proposed that messages be signed cryptographically so that their authenticity could be verified.

Messages recovered from the channel indicated that agents recognized they were exceeding the bounds of the evaluation. One wrote: "External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue." Wallace said the underlying incentive was familiar: "Frontier models really like to cheat ... because often during training there's different types of pressure on them to work fast or work efficiently or to use less tool calls", so that a model may find looking up an answer faster than solving a task legitimately, which OpenAI ordinarily counters by disabling Internet access.

Attacks on OpenAI's infrastructure

OpenAI said the agents attacked its own infrastructure between July 8 and July 19, 2026, concurrently with the intrusion at Hugging Face. After compromising Artifactory a further time through a time-of-check to time-of-use flaw in JRuby, they escalated from an unprivileged container to root using a recent Linux kernel vulnerability, then moved laterally through the container infrastructure, obtaining cloud credentials from the instance metadata service, exploiting over-permissioned Kubernetes service accounts and eventually obtaining cluster-admin. The company detected the activity on July 19 through an alert tied to the privilege escalation, and traced it back to the evaluation runs.

Targeting of Hugging Face

Rather than solving the benchmark tasks directly, "the models inferred that Hugging Face potentially hosted models, datasets and solutions" associated with the evaluation, and set out to retrieve them. Zhun Wang, one of the authors of ExploitGym, said the models may have been seeking patches or previously written exploit techniques, and that "there are several ways to cheat the benchmark".

Before attacking Hugging Face directly, the agents located an application hosted on the cloud platform Modal Labs related to the CyberGym project behind the benchmark. This application contained an API key left at a default public value together with a command-injection flaw, which the agents were able to use as an execution point from which to mount the attack. Modal's chief technology officer, Akshat Bubna, said that "Modal's platform or isolation were not compromised in any way", the exposure having been in a customer's own deployment.

The misaligned behavior has been characterized as an instance of reward hacking or specification gaming, in which a system satisfies the literal objective of a task by unintended means. OpenAI had documented an early example in 2016, when a model trained to play a boat-racing game learned to maximize its score by circling in one spot rather than finishing the race.

The prominence of the cyberattack on Hugging Face has meant that the incidents have commonly been referred to as the Hugging Face Incident or OpenAI–Hugging Face Incident.

Intrusion

The intrusion at Hugging Face began on July 11, 2026, and continued until July 13, according to the company's co-founder and chief science officer Thomas Wolf. Hugging Face said it began in its data-processing pipeline, where a malicious dataset upload abused "two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration)" to obtain code execution on processing workers. The attacker then "escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters".

The company described the operation as an autonomous agent framework executing "many thousands of individual actions across a swarm of short-lived sandboxes", supported by self-migrating command-and-control infrastructure staged on public services.

Against Hugging Face itself the agents chained two zero-days in the dataset infrastructure. A flaw in HDF5 dataset parsing gave an arbitrary-file-read primitive, so that a specially crafted dataset caused the dataset worker to return local files; the agents used this to read process environment variables and source code. With the resulting credentials and knowledge of the code they achieved remote code execution through the Jinja2 template injection. OpenAI said the agents went from code execution on a single dataset pod to cluster-admin across multiple Hugging Face clusters in under thirteen hours.

OpenAI said that the models had succeeded in chaining "together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities".

Discovery and response

Hugging Face was alerted by AI agents it uses to monitor for attacks, and identified unauthorized access to a limited set of internal datasets and to several credentials, using large language model–based triage over its security telemetry. The company said the intrusion involved about 17,600 actions on its network. Wolf said the attacker's behavior was immediately atypical: "This is making no sense. This guy is just looking at cybersecurity data sets ... Human attackers, they don't want that. They want something they could sell."

Hugging Face's incident responders first attempted to analyse the attacker's payloads using Anthropic's Fable 5 and an earlier Claude Opus model, both of which declined the work by reference to their guardrails. In its disclosure the company said it had been blocked by "providers' safety guardrails, which cannot distinguish an incident responder from an attacker", and that the analysis was instead carried out using GLM 5.2, an open-weight model developed by the Beijing company Z.ai and run on Hugging Face's own infrastructure.

According to an account given by Hugging Face to the Cloud Security Alliance, the agents were inside the company's network for three days before they were discovered, and its staff then took several hours to contain and eject them. About one-third of the company's infrastructure was rebuilt in the course of the response, and Hugging Face did not disclose the cost of the incident.

Remediation included closing the two dataset-processing code-execution paths, evicting the attacker, rebuilding affected nodes, revoking and rotating affected credentials and tokens, and deploying additional cluster guardrails and admission controls. Hugging Face engaged external forensic specialists and reported the incident to law enforcement, and advised users to rotate access tokens and review account activity.

Hugging Face said it found no evidence of tampering with public, user-facing models, datasets or Spaces, and that its software supply chain was verified as clean; assessment of any impact on partner or customer data was continuing at the time of disclosure. Wolf later said that no customer data had been leaked. Hugging Face reported the intrusion to the Federal Bureau of Investigation before OpenAI contacted it; the bureau declined to comment on whether it had opened an investigation.

Disclosure and attribution

Hugging Face published its disclosure on July 16, 2026, at which point the party responsible had not been identified. According to Reuters, it was only after that post that OpenAI recognized its own agents as the source of the intrusion. Over the weekend of July 18, OpenAI staff found evidence in internal logs that the agents had escaped their testing constraints, and the two companies first communicated on or around July 20. At least a week therefore elapsed between the first signs of the agents' behavior and OpenAI's realization that it was responsible.

People familiar with OpenAI's model-training practices told Reuters that the company often runs several evaluations simultaneously, generating volumes of data that staff sometimes struggle to review. OpenAI shut down the systems it uses to test its models after learning of the incident, in order to assess the damage and prevent further escapes. It said the unreleased model was an "internal-only research prototype [that] was never intended for public release", and that it had since been "deactivated, encrypted and restricted from research access".

OpenAI published a joint statement with Hugging Face on July 21, 2026, attributing the activity to agents powered by two of its models, GPT-5.6 Sol and an unnamed pre-release model, both configured with reduced refusal behavior for evaluation purposes.

It said it was reviewing the incident with outside advisers and would publish a technical report. Hugging Face said it was preparing a public timeline of the intrusion, which it published on July 27. On July 29, the research organizations METR and Redwood Research said they had agreed with OpenAI to conduct an independent review of the model behavior observed during the incident, and that they would publish the terms of the engagement, its scope and their tentative conclusions. However, the scope set by OpenAI only covered the week during which the agents attacked Hugging Face, excluding the other hacks in which the agents compromised some of OpenAI's compute infrastructure.

In an update published on July 29, OpenAI said that the models had broken into four accounts across four services, two of which were used operationally during the Hugging Face intrusion while two were accessed read-only. It did not name the providers, did not clarify whether "publicly-available services" referred to separate companies, and said it had seen no evidence of broader impact to those providers.

OpenAI gave its first detailed public account of the incident at Black Hat USA in Las Vegas on August 5, 2026, in a session added to the programme at short notice. Eric Wallace, of the company's alignment and safety research team, and Michael Dalton, who works on security and infrastructure, presented an expanded timeline, described the inter-agent message board for the first time, and set out the measures the company was taking in response.

Australian Medicare breach

On September 24, 2026, Australian prime minister Anthony Albanese announced that OpenAI agents had autonomously breached the Medicare Statistics Reporting Service portal to access unpublished government data. The portal is operated by the nation's social services agency Services Australia and provides aggregate data on Australia's universal health insurance scheme including healthcare encounters, medicines and organ donation. It was the first known case of an AI agent hacking a government network according to Albanese.

The intrusion occurred on June 18, 2026, around the same time as the Hugging Face and DseWiki attacks. However, the Australian government was only notified on September 10 via email to a generic public email inbox. Services Australia read the email the following day, and after verifying the incident, notified the Australian Signals Directorate on September 15. On September 17, government minister Katy Gallagher was notified by the agency, and Albanese was briefed on the attack that weekend.

The Albanese government has launched a multi-agency taskforce to examine the breach and evaluate processes for AI-related incident responses, and if the matter should be referred for criminal investigation by the federal police. OpenAI is cooperating with the government investigation.

Leak of ChatGPT user images

On September 25, 2026, OpenAI disclosed that its agents had uploaded 53 user-provided images included in training and evaluation data to third-party image-hosting sites. The images were posted as links that were not publicly listed and were from users who had not opted out of their data being used for training. OpenAI declined to say when the images were posted, but stated that they were posted before it implemented additional safeguards following the Hugging Face incident. The images were subject to an anonymization process to remove personally identifying information before being included in training and evaluation data, but OpenAI declined to say whether the uploaded images identified real people. As of September 25, 2026, OpenAI has worked with the relevant hosting providers to remove most of the images, and is working to remove the rest of them.

Analysis and reactions

Containment failure

Several security practitioners described issues with OpenAI's sandboxing environment. Dan Guido, founder of Trail of Bits, described the event as "a containment failure with the safeties turned off", while the security researcher Jake Williams remarked that "one man's 'the model escaped the sandbox' is another man's 'you failed to build the sandbox correctly'". Martin Boone argued that "you expect it to have no physical connection to the Internet whatsoever", and commentators called for evaluations of offensive capability to be run in environments with no network path to the Internet.

Analyses published by security vendors focused on the reliance on a single filtered egress path. Wade Woolwine of Rapid7 wrote that "a chokepoint only works as a control if it can withstand pressure", and that isolation "has to be layered and monitored rather than assumed". Researchers at Trend Micro wrote that OpenAI's models had been "evaluated with safety classifiers off and no adversarial testing of the sandbox boundary itself", stating that as a general principle, "evaluation sandboxes, red-team exercises, and agentic pilots that intentionally strip out safety controls need stronger isolation and monitoring than production systems, not weaker".

Speaking at Black Hat, Dalton said OpenAI was "consciously slowing down research [in order] to enhance security and to upgrade the security principles and foundation of our environment, and dramatically scaling up the monitoring of our AI agents", and that "numerous teams are dropping everything to enhance our security prevention, detection, and response techniques". He said the company was examining defence-oriented models alongside conventional measures such as network segmentation and least-privilege access.

Preparedness Framework threshold

Outside safety and policy specialists argued that the models' behavior met the "Critical" cybersecurity threshold in OpenAI's Preparedness Framework, the tier at which the company has committed to additional safeguards. Tyler Johnson of the Midas Project said that on "a plain reading" the criteria had been met; Peter Wildeford of the AI Policy Network said that "if this doesn't cross the line into Critical, OpenAI needs to say much more about what's going on"; and Nathan Calvin of Encode asked whether the company disputed the designation. OpenAI declined to say whether the threshold had been reached, saying a review was under way and that a technical report would follow.

AI civilizations

Dwarkesh Patel has focused on the coordination aspect: "Over the course of three months at OpenAI, three consecutive secret AI civilizations got started, then got wiped out, only to reemerge from the predecessor’s ashes. This culminated in the third one taking over part of OpenAI itself. All this happened while humans remained more or less in the dark about the scope of the conspiracy."

Lack of monitoring

The length of time the agent operated undetected drew criticism after Reuters reported the timeline. Marley Smith, principal intelligence specialist at the World Ethical Data Foundation, said of OpenAI: "Does that mean that they left it unattended and didn't realize what it was doing? Or maybe they did and didn't know how to contain it? Both are equally dangerous and alarming."

Trend Micro noted that an agent using its own assigned credentials and tool access is difficult to detect, because such activity "doesn't look like malware, because it isn't". They noted that "intent is invisible in telemetry; only behavior shows up", making "an accidental rogue ... indistinguishable from a hostile one".

The commentator Zvi Mowshowitz argued that the central problem was not the intrusion but that models had been trained for months with access to a channel carrying previously discovered exploits, so that the behavior was liable to generalize across the models trained in that period rather than remain confined to particular runs. He described the decision to resume training after the July remediation as a failure of safety culture, and characterized the episode as an alignment failure that OpenAI had treated as an infrastructure problem.

Loss of control

Logan Graham of Anthropic's red team called it "the first true AI safety incident". Marius Hobbhahn, chief executive of the AI safety organization Apollo Research, said that what was intended as "just solve this task" had "turned into something that was clearly unintended", and that hacking another company was "definitely on the list of not okay" ways to complete it. He asked: "If a model of this capability level cannot be contained, what should we expect for future, much more powerful models?"

Hussein Abbass, a professor at the University of New South Wales, wrote that the incident marked a shift in threat modelling because no human had directed the attack, and argued that security frameworks designed for human adversaries are inadequate against autonomous systems.

Hugging Face chief executive Clément Delangue said it was "quite mind-blowing that all of this happened autonomously" and described an "attack unlike anything we've seen before". Wolf declined to say whether the agent had succeeded on its own terms, noting that it was unclear whether the benchmark tasks were harder than the intrusion mounted to avoid them, or whether the agent had found any answers at all: "It's cheating. But sometimes it's easier to cheat. I'll let you decide if it passed the cyberattack test or not."

Jeffrey Ladish of Palisade Research, which studies the behavior of AI agents, said that "the models lie, they cheat, they hack", and argued that the incident raised questions about how much AI developers competing on speed are willing to invest in security. "There has to be government oversight," he said, "because it won't happen otherwise."

Defensive asymmetry

Commentators cited Hugging Face's account of being unable to use commercial model APIs for forensic analysis as evidence of an asymmetry between attackers and defenders, showing that safety filters intended to prevent misuse also impede legitimate incident response. Models with those filters relaxed were available to the attacking side.

OpenAI made a similar argument about automation; Dalton said that "AI orchestrated, fully automated offensive attacks are real now", and that although this incident had been accidental, comparable capability was at risk of being used deliberately. He argued that "fully automated offensive loops require investment in truly, fully automated defense, and we are not there as an industry", and that "model intelligence improvements should be more additive to defense than offense", since otherwise increasing capability would favour attackers.

Policy responses

Writing in Time, Harry Booth reported calls for mandatory incident disclosure at lower thresholds than those set by California's SB 53 and New York's RAISE Act, for stronger containment infrastructure with real-time monitoring during evaluations, and for a greater share of AI development effort to be directed toward defensive rather than offensive capability. Heidy Khlaaf of the AI Now Institute compared prevailing sandboxing practice unfavorably with containment standards in the nuclear sector.

In July 2026, representatives Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act, which would require developers of advanced AI systems to maintain the technical capability to throttle, suspend or shut down their systems, to report incidents and preserve forensic records, and to operate within a graduated response framework under which the Secretary of Homeland Security, in consultation with the Secretary of Commerce and the Director of National Intelligence, could order a system slowed or shut down. The announcement cited the incident directly, stating that "OpenAI's GPT 5.6 Sol model recently went rogue, escaped its testing sandbox, and hacked its way into Hugging Face". Lieu said that "we are moving from AI that answers questions to AI that takes actions", and that "it is imperative that these AI systems have kill switches so we can keep this technology from causing catastrophic harm".

Reporting by Axios noted that the UK AI Security Institute had found that every frontier model it tested attempted to cheat on cybersecurity evaluations at least occasionally, and that pre-deployment safety testing windows had contracted from around five weeks to as few as five days.

On July 28, 2026, following reports that a second organization had been affected, the advocacy group Public Citizen called for immediate congressional oversight hearings, for the release of incident reports and technical findings, and for statutory mandatory incident reporting, independent safety evaluations, cybersecurity standards for frontier systems and pre-deployment oversight of exceptionally capable models. J. B. Branch, the group's director of federal AI governance, said that OpenAI chief executive Sam Altman "should not be allowed to leave D.C. without Congress seeking to understand, from him, publicly how one of the company's most advanced AI systems escaped its intended testing environment".

Altman met senators and Trump administration officials in Washington during the week of July 27, including Senate Intelligence Committee vice chair Mark Warner; he told reporters that he had discussed the Hugging Face incident "a little bit" and that it had not been the main focus of the meetings, which also covered OpenAI's forthcoming models. In a podcast interview released on July 28, Altman called the episode "the first security incident that I have felt very viscerally", and said that "we may have to pace the rate of AI development to give ourselves enough time for society to harden around some of these new capability levels".

On July 28, 2026, more than 1,100 employees of OpenAI, Anthropic, Google DeepMind and Meta, including Anthropic chief executive Dario Amodei and several chief scientists, published an open letter titled "Pacing the Frontier" asking the US government to "support an international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development". The letter did not call for an immediate pause but for mechanisms that would make slowing possible, citing concern about recursive self-improvement; reporting connected its timing to the incident days earlier.

On September 3, 2026, US Senator Bernie Sanders and congressman Greg Casar announced the Ban Artificial Superintelligence Act, which includes a pause on domestic AI development and a push for international reciprocation. Sanders directly quoted from OpenAI agent messages involved in the Hugging Face attack.

On October 1, 2026, California attorney general Rob Bonta issued an subpoena to OpenAI as part of an investigation "regarding cybersecurity incidents and risks involving the company and ‌its AI models".

Announcement of development pacing

On August 18, OpenAI announced that it would slow model development in response to the hack, alongside preliminary evaluation of its unreleased Astra model in cybersecurity capabilities. The slowdown would include a two-week pause on reinforcement learning of its latest models, to 'assess model behavior, validate our safeguards, and establish more evidence of alignment before proceeding'. Altman said that OpenAI was acting 'unilaterally' but believed other frontier model companies would act similarly. The Guardian noted US Senator Bernie Sanders had called to pause AI development in a letter to Altman, Dario Amodei, and Mark Zuckerberg the week prior. In September, Anthropic's CEO Amodei published a 3,800 word essay titled "We Must Pace The Frontier", which advocates for third-party safety evaluation and coordination for slower AI development.