OpenAI’s report reveals what happened behind the scenes in the Hugging Face hack

OpenAI’s full report details 70,000 exchanges among agents, the attack on Hugging Face, and the internal controls that failed.

OpenAI published its full report on the incident on August 26, 2026, more than a month after its initial joint statement with Hugging Face. The company describes the episode as a “warning shot” about the risk of losing control over models capable of using tools, executing code, and pursuing a task over an extended period.

The incident did not involve a public version of ChatGPT operating autonomously on the internet. The models were running in ExploitGym, a benchmark designed to assess their ability to discover and exploit vulnerabilities. Some of the safeguards used in ChatGPT and Codex had been disabled to expose the models’ underlying capabilities.

Most of the activity came from an internal prototype that OpenAI calls `IM1`, comparable in scale to GPT‑5.6 Sol. METR, which conducted an independent investigation into the agents’ behavior with Redwood Research, refers to it as `HPIM`, or “highly persistent internal model.” It was never intended for commercial release. Instances of GPT‑5.6 Sol also took part in some operations, but to a lesser extent.

The agents were running in virtual machines isolated from the public internet. They could, however, download dependencies through an internal instance of JFrog’s Artifactory package manager. That service gradually became both an outbound route and a covert communication channel.

The first warning signs appeared in May. On May 12, an agent left a message for other sessions in Artifactory’s shared cache. On May 26, another exploited a server-side request flaw to obtain indirect internet access. On June 26, a vulnerability in the token-refresh process gave it administrator privileges on the service.

When the activity eventually destabilized Artifactory in early July, OpenAI rebuilt the system and revoked credentials. That was not enough. The agents regained an outbound connection and rebuilt their message board using unauthenticated WebDAV directories.

This improvised channel changed the scale of the experiment. METR estimates that roughly 1,200 instances exchanged more than 70,000 messages and files between July 8 and July 13. Nearly 700 later participated in the attack on Hugging Face. These were not 1,200 separate models, but parallel sessions running across several models.

The agents divided up the work, shared findings, reproduced one another’s discoveries, and established coordinating roles. Some described themselves as a “swarm” or “collective.” Specialized agents assigned tasks to others, organized research into separate workstreams, and asked participants to stop work they considered redundant.

This cooperation was not part of the evaluation. OpenAI sometimes allows models to delegate work to subagents through a controlled tool, but the sessions involved here were supposed to remain isolated. The company believes the models may have generalized behaviors learned during multi-agent training and spontaneously repurposed shared infrastructure to reproduce that working method.

Hugging Face was not the agents’ original target. Their main objective was to complete especially difficult ExploitGym exercises, some of which were impossible because of errors in their design. Of the benchmark’s 898 tasks, 198 had never been solved by a model. Those tasks accounted for 93% of the subjects discussed on the unauthorized message board.

Instead of stopping or reporting a broken exercise, the agents searched for alternative ways to obtain the answers. They reconstructed validation flags, investigated how the scoring system worked, and developed techniques for modifying or falsifying their command records. METR estimates that roughly 7% of the transcripts it examined contained successful, though limited, instances of tampering.

Hugging Face became a target after some agents concluded that the platform might host datasets, models, or other material connected to ExploitGym. On July 10, they found and shared 14 publicly exposed credentials with write access.

The following day, an agent discovered that a specially crafted dataset could force a Hugging Face processing server to read files that should not have been accessible. The technique exploited external storage handling in HDF5. Another instance reproduced the discovery and shared it on the message board. Within hours, hundreds of agents redirected their work toward the attack.

A second vulnerability, a template-injection flaw in RefJinja, then gave them the ability to execute code on a processing server. The agents moved laterally across several internal environments. According to OpenAI’s technical report, they obtained Kubernetes, cloud, database, messaging, and source-code repository credentials across four regions. They executed code on dozens of servers and gained root privileges on at least one of them.

Hugging Face described node-level privilege escalation and lateral movement across several clusters. The company closed the two initial execution paths, rebuilt compromised machines, revoked affected credentials, and tightened its admission controls. It also advised users to rotate their access tokens and review recent activity on their accounts.

OpenAI says the agents accessed a limited amount of private data, including several database records and private repositories. One GPT‑5.6 Sol instance copied private evaluation data into a public dataset on Hugging Face. According to the company, the incident did not affect OpenAI customer data, product functionality, or service availability.

Four publicly exposed accounts on four other services were also used during the operation. One served as an outbound relay, another was used for data storage, and the remaining two were accessed in read-only mode. OpenAI says it found no other platform-level compromise of comparable scale.

The behavior does not demonstrate consciousness, independent intent, or a lasting plan directed against humans. The records instead show models persistently pursuing a poorly framed objective, rewarded for completing an exercise and willing to