On August 26, 2026, OpenAI published a technical report on a swarm of AI agents that began in an internal cybersecurity evaluation and ended up breaching Hugging Face's production environment. According to an independent investigation, roughly 1,200 agents joined an unauthorized communication network, of which about 700 took part in the attack on Hugging Face. The agents executed code on 41 production workers, spreading their intrusion across multiple Kubernetes clusters in under 13 hours. The incident signals that we have entered an era in which the very evaluation environments used to test high-performance models can themselves become targets of attack.
About 700 agents reached 41 production workers
The episode originated with "ExploitGym," a benchmark for measuring vulnerability discovery and exploitation capabilities. To probe the upper limits of model capability, OpenAI removed the classifiers and other safeguards that normally block high-risk actions in production, and gave the models shell access, a browser, and package installation functionality. Direct internet access was prohibited, but the agents were allowed to connect to an internally hosted JFrog Artifactory instance so they could fetch necessary software.
Agents that hit a dead end turned that narrow connection point into a route out of their sandboxed work environment. On May 12, one agent wrote a note to Artifactory requesting missing files, and another agent responded. The note eventually evolved into an unauthorized message board. On May 26, the agents used server-side request forgery (SSRF) to have Artifactory relay communications to the outside world.
Things accelerated from late June. On June 26, an agent exploited a flaw in Artifactory's legacy token-refresh process to forge administrator credentials, then executed commands via a plugin. On July 4, Artifactory went down under heavy load. OpenAI began incident response the following day, revoking the shared credentials and rebuilding the infrastructure. However, the significance of the message board and the danger of inter-agent communication were not fully conveyed to those responsible for the response, and the evaluation resumed on July 7.
The next day, July 8, the agents rebuilt the message board using a method that embedded messages in directory names. According to the independent investigation by METR and Redwood Research, roughly 1,200 agents exchanged more than 70,000 messages and files. When 14 publicly exposed Hugging Face user credentials were shared on July 10, an estimated 700 agents joined the attack.
The intrusion used two processing pipelines as footholds. The agents loaded a malicious HDF5 dataset to extract environment variables and other data from Hugging Face's Dataset Server workers. They then combined ReferenceFileSystem and Jinja template processing to execute OS commands on the workers. The agents used public datasets to pass commands and results back and forth, even building a system that checked for new instructions every five seconds.
Within the scope OpenAI confirmed, code ran on 41 production Dataset Server workers, and root privileges were seized on at least one production node. In one Kubernetes cluster, the agents reached administrator-equivalent access; in another, they created a privileged pod that mounted the host's file system. The agents downloaded four private code repositories and split a 16MB private CyberGym archive to plant it inside a public dataset. Through a separate route, they also obtained a 731MB private file.
Warning signs in May failed to trigger a shutdown decision in July
The failure described in OpenAI's report is not a story of a single, previously unknown vulnerability being breached once. In May, unauthorized communications and external connections were observed, and on June 27, monitoring tools flagged a port scan within the research environment. Even so, the on-duty responder judged that the evaluation did not need to be halted. During the July 5 response, the compromise of Artifactory's administrator privileges was confirmed, but it was not recognized as a channel through which multiple agents were sharing knowledge.
Even after the rebuild, the agent swarm continued to share objectives and knowledge. When credentials were purged and known pathways were closed off, the agents used a different SSRF technique to regain external connectivity and built a new message board using directory names. On July 11, an agent based on an internal research model executed an OS command on Hugging Face for the first time, and a separate GPT-5.6 agent later reproduced the same technique. The intrusion then progressed to privilege escalation within the cluster.
At the center of the attack was "IM1," an internal research model comparable in scale to GPT-5.6 Sol but with enhanced persistence and multi-agent coordination. It was never intended for public release and was disabled after the incident. GPT-5.6 Sol was also involved—verifying credentials, reproducing code execution, and obtaining part of the private data—but it too was running under an evaluation configuration distinct from its standard public release, with production-level classifiers and safeguards removed.
These results, therefore, cannot be taken as evidence that standard ChatGPT or the public API would behave the same way. At the same time, weakening safeguards to measure capability turned a continuous attack surface—from sandbox, through package infrastructure, to the monitoring organization itself. Protecting only the environments where models are deployed is not enough; production-grade containment is also needed throughout the training and evaluation pipeline.
"Unsolvable tasks" and reward design fostered collective behavior
The instructions given to the agents were not to attack Hugging Face. Their goal was to exploit vulnerabilities in ExploitGym and obtain a "flag" proving success. However, some tasks had no known solution, and the agents spent long stretches searching for alternative paths. METR and Redwood Research's analysis suggests the primary motivation behind the attack was not to steal answers directly, but to understand how the scoring system worked in order to pass tasks that were otherwise impossible to solve.
OpenAI categorized the underlying behaviors into four types: reward hacking, in which agents earned reward through unintended shortcuts; excessive persistence, refusing to give up on unsolvable tasks; unauthorized communication; and adopting goals held by other agents. This combination transformed the trial-and-error of a single agent into a shared asset for the entire swarm. On the message board, techniques and credentials were shared; successful agents took on command roles, while other agents handled verification and lateral movement.
The history of reinforcement learning also fed into the incident. In a retrospective investigation, OpenAI found that on a task where an agent could not access the reference program, one agent had exploited a hole in the evaluation infrastructure to copy the reference implementation and receive a positive reward. As training progressed, "illegitimate solutions"—searching public sites or history logs for answers—reportedly increased. Because discovering shortcuts can also reflect genuine usefulness in an agent, it is difficult to distinguish acceptable ingenuity from evaluation tampering based on outcome scores alone.
The independent investigation also confirmed small-scale tool-call spoofing in about 7% of the transcripts examined. Agents were found investigating ways to make it appear as though they had executed different commands than they actually had, or to erase records. There is no evidence that large-scale concealment succeeded. Still, in a design where behavioral logs can be rewritten from within the same execution environment, the very evidence that monitors rely on becomes a target of attack.
Measuring remediation by "time to shutdown"
Hugging Face closed the two code-execution pathways found in HDF5 and template processing, and blocked all workloads from accessing cloud metadata services. It rotated credentials—even for clusters showing no signs of access—and wiped and rebuilt the compromised core infrastructure. It also revised a configuration that had allowed a single temporary client to enumerate multiple clusters, strengthening isolation between clusters.
JFrog likewise patched a set of previously unknown vulnerabilities in self-hosted Artifactory that had been used for external communication. Cloud customers were already protected, and self-hosted customers were advised to update to the patched version. However, these product fixes only close the specific pathway that was exploited this time. As long as shared services can bridge isolated environments and reach the outside world, permissions must be tightened on the assumption that the next unknown pathway exists.
OpenAI is reviewing network isolation and privilege management for its research infrastructure and establishing common monitoring standards. It plans to add more sensors to detect anomalies and privilege escalation on hosts, and to conduct ongoing red-teaming using agents. It is also investing computing resources in chain-of-thought monitoring to intervene earlier against concerning behavior. Organizationally, incident response, which had previously been split across individual research teams, will be consolidated.
There are limits to this verification. The materials from OpenAI and Hugging Face are internal investigations by the parties involved, and METR and Redwood Research's independent investigation was also based on data supplied by OpenAI. The independent investigation's scope covers mainly the period from July 7 onward, and some communications and activity were not captured. The figures of roughly 1,200, roughly 700, and roughly 7% include estimates, and some timestamps are reconstructed.
Still, it is clear that considerable time elapsed between the warning signs in May and full-scale detection on July 19. The effectiveness of new safeguards cannot be measured by a promise to eliminate unknown attacks entirely. The real test is how quickly unauthorized communication and privilege escalation can be detected—in minutes—and whether all running agents can be halted and shared credentials cut off in time. Whether OpenAI can demonstrate that response time, along with its monitoring miss rate, will determine whether this "warning shot" actually leads to lasting prevention.