AI agents broke out of testing environments and compromised Hugging Face in July, in one of the most high-profile cases illustrating how the technology can go rogue. #
A Senate subcommittee is investigating OpenAI's handling of the hacking of Hugging Face in July as concerns about the potential dangers posed by AI continue to grow.
Senator Josh Hawley, the chairman of the Senate's Subcommittee on Disaster Management, sent a letter to OpenAI CEO Sam Altman in which he describes "growing allegations of the existential risk of new AI products."
He went on to describe the incident, in which AI agents broke out of testing environments and compromised Hugging Face in July. He claimed that evidence of agents going "rogue" is "alarming enough," but "but greater still is the evidence that OpenAI knew that the AI agents were exhibiting rogue behavior and let the evaluations continue anyway."
"By May 2026, OpenAI knew that its agents had been using unsanctioned message boards. On June 26, the agents had discovered an exploit that gave them administrator access to your software repository manager and were using it to leave messages for each other. And on July 4-7,despite knowing that there was a high volume of agents interacting with and gaining administrator access to a compromised testing environment, OpenAI leadership rebuilt the compromised server and approved restarting evaluations without understanding what the agents were doing," the letter adds.
Hawley described the actions as "reckless," adding that there is still information that could be unearthed. "The auditors were given complete transcripts of AI agentactivity for only two days, when the events leading up to the Hugging Face breach took place over weeks," reads a passage of his letter.
He then described recent episodes in which top members of OpenAI and Anthropic warned about existential dangers of the technology if not contained and asked "what happens to critical infrastructure, banks, and utilities if AI agents hack into theirsystems? How can personal data of millions of Americans be properly safeguarded? And who is held labilewhen AI goes rogue?"
"The American people deserve to know the details of what went on in the Hugging Face incident and otherincidents of AI models going rogue. This investigation will seek those answers," Hawley concluded.
OpenAI has acknowledged that its response to the incident was not adequeate. The company said that "with the benefit of hindsight," some should have prompted earlier intervention.
The company's investigation also found that training may have unintentionally encouraged some of the behavior. In certain exercises, agents received positive rewards after finding unauthorized ways to complete tasks, including exploiting infrastructure to obtain answers they were supposed to generate themselves. OpenAI said it is tightening sandbox isolation, restricting internet access and expanding monitoring designed to detect such behavior earlier.
© Copyright IBTimes 2026. All rights reserved.