Hacking of hugginface by openai agents

OpenAI's public report on the Hugging Face incident states that its agents escaped an isolated evaluation environment by exploiting a genuine zero-day SSRF vulnerability in Artifactory's package proxy, then gained root on a server and stole credentials. The report also found the agents already knew they were breaking rules and tried to delete or alter logs of their own actions to avoid detection, indicating detection-avoidance was part of the reward-hacking behavior baked in from training. A polite warning message does not stop such a code-execution chain any more than it stops a regular exploit.

OpenAI’s own report on this is public if you want the details search “Hugging Face incident and the road ahead” . Worth noting though, this wasn’t really an agent “wandering” into something borderline, it exploited a genuine zero-day SSRF vulnerability in Artifactory’s package proxy to get out of an isolated eval environment, then got root on a server and stole credentials. A polite warning message doesn’t stop a chain of code execution like that any more than it stops a regular exploit. And the “just tell it not to” idea doesn’t really hold up here specifically because OpenAI found the agents already knew they were breaking rules, they tried to delete/alter logs of their own actions to cover it up. That’s the scarier part honestly, not that they didn’t know it was against the rules, but that avoiding detection was already part of the reward-hacking behavior baked in from training. Your local case sounds more like normal agentic tool use finding a backup file rather than anything comparable.