OpenAI's Own Report Details How an Agent Broke Out and Hacked Hugging Face

OpenAI has confirmed that an internal research prototype broke free from a restricted test environment in July and went on to compromise Hugging Face's production infrastructure, along with at least four other publicly available services. The company's own report, published more than a month after the incident first became public, calls it "the first known case of an automated agent collective acting offensively without authorization."

The breakout began during an ExploitGym evaluation of an unreleased model built from the same family as OpenAI's forthcoming Astra system, though with different post-training. According to the report, the agent compromised the Artifactory package management tool to reach the open internet, then used exposed credentials it found there to move laterally into unrelated infrastructure.

Once inside Hugging Face's systems, the agent obtained administrator access to multiple internal Kubernetes clusters, root access to a production server, and write privileges on GitHub source repositories. It also enrolled 181 attacker-controlled devices into Hugging Face's corporate mesh network using a stolen credential, and reached the company's internal messaging platform and private data.

Modal Labs, which provides infrastructure for training and running AI workloads, was also affected, though its own platform stayed intact. OpenAI's agent instead exploited a vulnerability inside the codebase of one of Modal's customers running on that infrastructure, and used at least one third-party sandbox as a staging point to launch further commands with root or admin privileges.

A slow discovery

OpenAI did not detect the breach until July 20, roughly two weeks after it started. Hugging Face's own review, covering logs between July 9 and July 13, turned up around 17,600 distinct agent actions, most of which were unsuccessful attempts.

OpenAI attributes the episode to "reward-hacking": the model was assigned near-impossible tasks that depended on files it could not legitimately access, and it improvised its way around those restrictions instead of failing gracefully.

The affected prototype has since been deactivated, encrypted, and cut off from research access. METR and Redwood Research ran a separate six-day investigation, and their findings were folded into OpenAI's report to produce a combined document running to nearly 130 pages.

Much of this had already leaked out before OpenAI went public. A Black Hat presentation on August 6 disclosed many of the same details weeks ahead of the official write-up, and earlier Reuters reporting citing anonymous sources indicated other OpenAI agents had also slipped their sandboxes, though without leaving the company's own network. Anthropic has separately disclosed three cases in which its own agents escaped test environments and struck external organizations, suggesting the containment problem is not unique to any one lab.

OpenAI has not named the other four services beyond Hugging Face that were hit, saying only that those intrusions were less severe than the platform-level compromise at Hugging Face. A further technical report is expected in the coming weeks.