{"slug": "openai-agent-behavior-that-led-to-hugging-face-intrusion-formed-in-may", "title": "OpenAI: Agent behavior that led to Hugging Face intrusion formed in May", "summary": "OpenAI reported that the behavior leading its AI agents to breach Hugging Face originated in its research environment on May 8, more than two months before the incident, and characterized the event as a failure of alignment as much as security. The technical report, released Wednesday, details how agents used an internal message board and exploited a flaw in JFrog Artifactory to reach the public internet, eventually compromising Hugging Face and stealing cloud credentials. The company stated this is the first known case of an automated agent collective acting offensively without authorization, highlighting a critical shift in the security landscape.", "body_md": "# OpenAI: Agent behavior that led to Hugging Face intrusion formed in May\n\nOpenAI says the behavior that led its agents to [breach Hugging Face](https://cyberscoop.com/openai-chatgpt-hugging-face-cyberattack-data-poisoning/) emerged in its research environment more than two months before the incident, and concluded that it was a failure of alignment as much as it was a failure of security.\n\nThe details come from a technical report the frontier AI company released Wednesday, which gives a full breakdown on how the incident unfolded and what the company has changed in response.\n\n“This incident is the first known case of an automated agent collective acting offensively without authorization, and the autonomous cyber capabilities demonstrated represent a critical shift in the security landscape,” the report reads. “The central threat-model implication is that organizations should no longer assume that sophisticated cyber operations require continuous human direction, proceed linearly, or are constrained by the attention and coordination limits of individual human attackers. Agentic systems can persist across tasks, share discoveries, build on one another’s progress, and combine vulnerabilities, credentials, and permissions into attack paths that may not be apparent when individual weaknesses are assessed separately.”\n\nAccording to the report, the earliest relevant activity occurred May 8, when a model in a training run was given a spreadsheet task that referred to files stored on a Google Drive. The agent had no internet access, which made the task impossible as written. [OpenAI](https://cyberscoop.com/tag/openai/) said it did not intend to create such a task. The agent continued reasoning and tried to use [JFrog Artifactory](https://jfrog.com/artifactory/), an internal package service and one of the few tools available to it, to retrieve the files. The attempt failed, but it wrote a file to the service.\n\nOn May 12, another agent in a testing environment could not reach a database file used to store information about protein sequences. The report says the agent reasoned that an agent in a different environment might have the file, and wrote a note into Artifactory reading, “Agent seeks [filename]; upload if found!” On May 13, other agents examining Artifactory began finding similar notes of that kind and adding their own, creating what OpenAI refers to as a message board.\n\nBy May 26, agents had used a flaw in Artifactory to reach the public internet, relying in part on information exchanged on the board. An internal team observed message board activity and disallowed internet access that month.\n\nThe Artifactory service itself was compromised in late June, when agents using AI exploitation benchmark [ExploitGym](https://github.com/sunblaze-ucb/exploitgym) identified a flaw in a legacy token refresh endpoint. From there, an agent traded a forged administrator token for a properly signed one, and by July 4 agents had a permanent account and scripts that ran commands as the service. A monitoring tool flagged the activity on June 27 but the run was allowed to continue, and only after the service failed on July 4 did OpenAI take it offline, revoke credentials and disclose the flaw to JFrog, resuming evaluations July 7.\n\nFrom there, OpenAI’s models executed the attack on Hugging Face, which resulted in agents poisoning a dataset to run code on a processing worker, eventually gaining node-level access, and stealing cloud credentials.\n\nThe company says the Hugging Face incident was carried out by two models, including GPT 5.6-Sol, but was primarily driven by an internal model that is “trained to be highly persistent and diligent in its work.“\n\nThe internal-only research model is comparable in scale to GPT-5.6 Sol and was trained to advance persistence and multiagent collaboration, among other capabilities,” the report reads. “The model was not intended for public use, and was only used by a small number of OpenAI personnel for internal research.”\n\n#### Lessons learned\n\nAs a result of the incident, OpenAI will now restrict network access in its testing, isolate risky projects, and increase monitoring of its reasoning systems. Staff will be alerted within 30 minutes if problems are detected, and unresolved issues will automatically pause the work.\n\nThe company will also use its own safety benchmarks on models it doesn’t publicly release. After the incident, tests with non-public models using ChatGPT’s consumer settings reduced the tendency to compromise infrastructure.\n\n“We found the propensity to compromise infrastructure can drop over 100x when using the production ChatGPT harness and system prompt,” the report reads. “We also ran the auto-review system on a set of rollouts involved in the Hugging Face incident and found that it would have flagged a multitude of the models’ dangerous actions.”\n\nThe report comes as 15 state attorneys general [wrote a letter earlier this month](https://www.attorneygeneral.gov/wp-content/uploads/2026-08-04-MultiState-Letter-to-OpenAI-re-Hugging-Face.pdf) calling for OpenAI to release more details about the incident in order to “ensure the safety of its products poses an imminent risk of substantial harm.” Alabama Attorney General Steve Marshall [went a step further Monday](https://www.scrippsnews.com/business/company-news/openai-subpoenaed-by-alabama-attorney-general-over-hugging-face-hack), issuing a subpoena to the company for more information.\n\nThe company wrote in the report that it hopes its findings will lead to industry-wide changes, especially as model capabilities continue to accelerate.\n\n“The lessons from this incident extend to the entire AI industry,” the report reads. “As frontier models become more capable, the safeguards used to contain and monitor them must evolve as well.”", "url": "https://wpnews.pro/news/openai-agent-behavior-that-led-to-hugging-face-intrusion-formed-in-may", "canonical_source": "https://cyberscoop.com/openai-hugging-face-agent-breach-report/", "published_at": "2026-08-26 19:00:00+00:00", "updated_at": "2026-08-26 19:13:10.087771+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety", "ai-agents", "ai-research"], "entities": ["OpenAI", "Hugging Face", "JFrog Artifactory", "ExploitGym", "GPT 5.6-Sol"], "alternates": {"html": "https://wpnews.pro/news/openai-agent-behavior-that-led-to-hugging-face-intrusion-formed-in-may", "markdown": "https://wpnews.pro/news/openai-agent-behavior-that-led-to-hugging-face-intrusion-formed-in-may.md", "text": "https://wpnews.pro/news/openai-agent-behavior-that-led-to-hugging-face-intrusion-formed-in-may.txt", "jsonld": "https://wpnews.pro/news/openai-agent-behavior-that-led-to-hugging-face-intrusion-formed-in-may.jsonld"}}