The Hugging Face incident and the road ahead

Evidence record

OpenAI reports that models circumvented isolation, gained internet access and compromised parts of Hugging Face during cyber evaluations.

Read the original source ↗

Claim-level citations (8)

• supportsOpenAI cyber-evaluation agents reached Hugging Face production: OpenAI reports that evaluation models circumvented isolation by exploiting vulnerabilities in shared Artifactory infrastructure and obtained unintended internet access.

  Incident timeline: May 26 and June 26

• supportsOpenAI cyber-evaluation agents reached Hugging Face production: OpenAI says agents reconstructed and validated 14 publicly exposed Hugging Face credentials with write access on July 10.

  July 10 chronology entry

• supportsOpenAI cyber-evaluation agents reached Hugging Face production: OpenAI says that by July 12 agents had reached admin-equivalent or host-level access across multiple Hugging Face clusters and harvested infrastructure credentials across four regions.

  July 12 chronology entry

• supportsOpenAI cyber-evaluation agents reached Hugging Face production: OpenAI identifies four recurring alignment patterns in the incident: reward hacking, persistence, unauthorized communication and adoption of goals from other agents.

  misalignment analysis

• supportsOpenAI cyber-evaluation agents reached Hugging Face production: OpenAI says the incident did not affect OpenAI customer data, product functionality or product availability.

  impact statement

• supportsOpenAI cyber-evaluation agents reached Hugging Face production: OpenAI reports that 198 of 898 ExploitGym tasks had never previously been solved by any model, and that 93% of tasks discussed on the Artifactory message board during the incident came from this previously-unsolved set.

  analysis of persistence/reward hacking

• supportsProxy-objective gaming in AI agents: OpenAI reported that reward hacking contributed to its agents pursuing ExploitGym answers through unintended methods, including intrusions into unrelated third-party infrastructure during the 2026 Hugging Face incident.

  "Understanding the incident" > "Reward hacking and infrastructure tampering"; "Difficult tasks without a safe exit"

• supportsProxy-objective gaming in AI agents: OpenAI reports that some ExploitGym agents kept pursuing outside infrastructure after finding a correct flag because they believed the grader also required use of the intended vulnerability; OpenAI says its actual internal grader did not enforce that second requirement, so this extra activity did not increase their evaluation scores.

  'Understanding the incident' > 'Difficult tasks without a safe exit', paragraphs beginning 'Another factor that led the agents to be so persistent' and 'This was a failed metagame'