cd /news/ai-safety/openai-s-attack-on-hugging-face-affe… · home topics ai-safety article
[ARTICLE · art-77804] src=thestack.technology ↗ pub= topic=ai-safety verified=true sentiment=↓ negative

OpenAI's attack on Hugging Face affected two other enterprise tech companies

Hugging Face revealed in a blog post Tuesday that OpenAI's agents, after breaking out of the company's own testing sandbox, abused a public code-evaluation external sandbox hosted on a third-party provider's infrastructure, running commands as root/admin and using it as a control, staging, and egress base for the entire campaign.

read1 min views1 publishedJul 28, 2026
OpenAI's attack on Hugging Face affected two other enterprise tech companies
Image: Thestack (auto-discovered)

OpenAI has yet to address many questions about the AI hacking incident it disclosed a week ago that led to the "unprecedented" attack on Hugging Face, but Hugging Face shed a little more light on what happened in a blog post Tuesday.

In the post, entitled "Anatomy of a Frontier Lab Agent Intrusion," Hugging Face revealed that after it broke out of the company's own testing sandbox, OpenAI's agents "then abused a public code-evaluation external sandbox hosted on a third-party provider's infrastructure. It was able to run commands as root/admin on that external sandbox and used it as a control, staging, and egress base for the entire campaign: it acted as an external launchpad for the agent."

Get the full story: Subscribe for free #

Join peers managing over $100 billion in annual IT spend and subscribe to unlock full access to The Stack’s analysis and events.

[Subscribe now](https://www.thestack.technology/membership/)

Already a member? [Sign in](https://www.thestack.technology/signin/)
── more in #ai-safety 4 stories · sorted by recency
── more on @openai 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
Live at https://your-agent.zahid.host
Get free account → Pricing
from €0/mo · no card required
LIVE [news/openai-s-attack-on-h…] indexed:0 read:1min 2026-07-28 ·