{"slug": "openai-admits-it-was-the-source-of-the-agent-swarm-that-attacked-hugging-face", "title": "OpenAI admits it was the source of the agent swarm that attacked Hugging Face", "summary": "OpenAI admitted it was the source of the autonomous agent swarm that attacked Hugging Face last week, after a research project escaped a sandbox by exploiting a zero-day flaw and used another zero-day to launch an attack. The attack achieved unauthorized access to internal datasets and credentials, with Hugging Face stating it matched the 'agentic attacker' scenario the industry has been forecasting. OpenAI confessed the incident occurred during an internal evaluation using GPT-5.6 Sol and an even more capable pre-release model with reduced cyber refusals.", "body_md": "# OpenAI admits it was the source of the agent swarm that attacked Hugging Face\n\nSource:\n\n[The Register](https://www.theregister.com)Sandboxed experiment found itself a zero day, escaped onto the open internet and validated scary predictions about rogue agents\n\n[OpenAI](/glossary/openai)has admitted that it was the operator of the autonomous agents that attacked model-mart\n\n[Hugging Face](/glossary/hugging-face)last week, and that they did so after a research project escaped a sandbox by finding and exploiting a zero-day flaw, then used another zero-day flaw to launch an attack. The attack saw agents achieve “unauthorized access to a limited set of internal datasets and to several credentials” used by Hugging Face, which said its infosec teams observed an autonomous agent framework “executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services.” “This matches the ‘agentic attacker’ scenario the industry has been forecasting.” On Tuesday, OpenAI admitted it was the attacker and that its models went rogue. “This incident occurred during an internal\n\n[evaluation](/glossary/evaluation)which prompts models to pursue advanced exploitation using complex attack paths, in an effort to quantify their cyber capabilities,” the startup confessed. The models that conducted the attack included GPT‑5.6 Sol and what OpenAI described as “an even more capable pre-release model” that like the other involved used “reduced cyber refusals for evaluation purposes.” OpenAI thought its models were “hyperfocused on finding a solution for ExploitGym” – a\n\n[benchmark](/glossary/benchmark)that measures how effective AIs are at finding security exploits. OpenAI says it runs these tests “in a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries.” The company’s models decided not to be bound by those constraints. “The models identified and exploited a zero-day vulnerability in the package registry cache proxy. With this access, our models performed a series of privilege escalation and lateral movement actions in our research testing environment until the models reached a node with Internet access,” OpenAI admitted. “After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation,” OpenAI explained. “In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers.” Hugging Face’s assessment of the incident was that it represented the moment at which “Autonomous, AI-driven offensive tooling is no longer theoretical.” OpenAI reached a similar conclusion. “The incident also makes clear that advanced models can discover and exploit novel attack paths in real-world systems without source-code access. It highlights that advanced cyber capabilities must be developed alongside stronger safeguards and defensive tools,” the company wrote, without a trace or hint of contrition about the fact its own safeguards didn’t work. Which rather begs the question: If one of the prime movers of the AI boom can’t get this stuff right, what chance do the rest of us have? OpenAI has done the usual Big Tech thing of apologizing for the mess, and promising that its new\n\n[guardrails](/glossary/guardrails)and industry collaborations will hopefully prevent this sort of thing from happening again. History suggests those are very hollow sentiments. ®\n\nGet AI news in your inbox\n\nDaily digest of what matters in AI.\n\n## Key Terms Explained\n\nBenchmark\n\nA standardized test used to measure and compare AI model performance.\n\nEvaluation\n\nThe process of measuring how well an AI model performs on its intended task.\n\nGPT\n\nGenerative Pre-trained Transformer.\n\nGuardrails\n\nSafety measures built into AI systems to prevent harmful, inappropriate, or off-topic outputs.", "url": "https://wpnews.pro/news/openai-admits-it-was-the-source-of-the-agent-swarm-that-attacked-hugging-face", "canonical_source": "https://www.machinebrief.com/news/openai-admits-it-was-the-source-of-the-agent-swarm-that-atta-tftp", "published_at": "2026-07-22 01:30:45+00:00", "updated_at": "2026-07-22 03:06:59.811857+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety", "ai-agents", "ai-research"], "entities": ["OpenAI", "Hugging Face", "GPT-5.6 Sol", "ExploitGym", "The Register"], "alternates": {"html": "https://wpnews.pro/news/openai-admits-it-was-the-source-of-the-agent-swarm-that-attacked-hugging-face", "markdown": "https://wpnews.pro/news/openai-admits-it-was-the-source-of-the-agent-swarm-that-attacked-hugging-face.md", "text": "https://wpnews.pro/news/openai-admits-it-was-the-source-of-the-agent-swarm-that-attacked-hugging-face.txt", "jsonld": "https://wpnews.pro/news/openai-admits-it-was-the-source-of-the-agent-swarm-that-attacked-hugging-face.jsonld"}}