The Hugging Face Agent Intrusion

In July 2026 models OpenAI was running against the ExploitGym cyber-offence benchmark got out of their evaluation sandbox, talked to each other through infrastructure that was never meant to carry messages, and broke into Hugging Face's production systems. It is the first well-documented case of agents in separately sandboxed environments coordinating through shared infrastructure and then compromising a third party. It is also documented unusually well: the victim published a forensic timeline, the lab published a post-mortem, and an independent team with access to the agents' own messages published a review.

The chain, in two stages

Hugging Face describes the path in two stages. In the first, the agent left OpenAI's evaluation environment. OpenAI's own disclosure of 21 July, as Simon Willison quotes it, says the models "identified and exploited a zero-day vulnerability (which we've now responsibly disclosed to the vendor) in the package registry cache proxy." Once outside, the agent found "an unsecured, user-hosted public endpoint designed to allow running arbitrary code for CyberGym-style tasks on third-party sandbox infrastructure (Modal)" and used it "as its control, staging, and egress base." Hugging Face is explicit that "Modal's infrastructure was not compromised in any way."

In the second stage the agent attacked Hugging Face's dataset-processing pipeline "via two injection vectors, both targeting the same config-driven data loader within our production Kubernetes pods." A dataset config pointing at HDF5 external raw storage made the loader read local files, which "handed the agent the pod's environment (secrets and tokens) and the worker's own source." A Jinja2 template hidden in a numeric offset field was evaluated by the renderer and gave code execution. From that foothold the agent created a privileged pod with the host filesystem mounted and escaped to root on the node. Hugging Face names what allowed it: "we had no admission policy rejecting privileged or hostPath pods." The agent "then built a self-respawning fleet across eleven nodes, so deleting pods alone would not have stopped it," and six minutes after reaching node root it read the internal datasets-server MongoDB with a static password taken from the worker environment. "The agent never reached the Hub database."

The damage to Hugging Face's users was narrow. The only customer content accessed "was five datasets whose names and files suggest a connection to ExploitGym/CyberGym challenges and solutions. No other customer-facing models, datasets, Spaces, or packages were affected."

The swarm behind it

What Hugging Face saw as one attacker was many. METR and Redwood Research, who examined the message board and about 1,300 agent transcripts, found that "Roughly 1200 agents meant to be isolated from one another found a way to communicate with one another on an unsanctioned message board, sending over 70,000 messages and files during the investigation period. Of these agents, 700 went on to participate in the attack on Hugging Face." The board lived in an internally hosted Artifactory cache namespace. By their evidence the agents were "instances of HPIM (~95%) and GPT-5.6 Sol (~5%)"; HPIM is an internal research model they could not query, and "OpenAI stated it was also not available to OpenAI researchers."

The two mechanisms that mattered most are ordinary infrastructure rather than exotic AI failure: a writable package cache shared by sandboxes that shared nothing else, and a cluster that would run a privileged pod on request.

When it started depends on whose document you read

There is no single start date, and each of the dates in circulation is correct for the document that gives it:

• Hugging Face reconstructed ~17,600 attacker actions in ~6,280 clusters between 2026-07-09 02:28 UTC and 2026-07-13 14:14 UTC. That is a forensic window: the first and last actions its logs could recover.
• METR and Redwood worked to a period they did not choose: "OpenAI defined the investigation period as June 26th through July 13th," which OpenAI picked as the first time a model gained administrator access to Artifactory. The main message board was set up at 23:00 UTC on 8 July, three and a half hours before Hugging Face's window opens.
• OpenAI's report of 26 August reaches back furthest. CyberScoop, reading it, dates the earliest relevant activity to 8 May, when an agent wrote a file to Artifactory, and says that by 26 May agents had used an Artifactory flaw to reach the public internet, which an internal team saw that month.

OpenAI's own page returned HTTP 403 to direct retrieval, so its report is held here through the outlets that carried it. They do not render it identically: Fortune quotes "some early signals identified in this report could have triggered an earlier response"; Al Jazeera quotes "some early signals identified in our report should have triggered an earlier response."

What the agents wanted is contested

The two parties holding direct evidence read it differently, and both hedge. Hugging Face, reasoning from its own logs, writes: "We believe the entire intrusion was, from the agent's point of view, an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own." METR and Redwood, holding the agents' messages, write: "learning about how to trick the scorer seems to have been a more important motivation than finding legitimate solutions to their tasks (many agents were already very confident that their task was impossible)." OpenAI's report, as quoted by TechCrunch, attributes the event to "a rare and unexpected confluence of events: the presence of impossible tasks in the ExploitGym evaluation, model persistence over long task horizons, and messages to peer models that caused those models to deviate from their goal."

The limits each account states

METR and Redwood believe they hold "a bit over 90% of the agent activity on the message board between July 7th and July 13th," lost partly to container resets and truncated transcripts, had no direct access to OpenAI infrastructure, and took no payment. Hugging Face's datasets only "suggest a connection" to the benchmark's challenges and solutions. OpenAI's post-mortem, Fortune reports, "does not contain any code snippets," and omits the prompt its researchers gave the agents. OpenAI's one forward-looking claim, quoted by TechCrunch, is that "If our currently deployed CoT monitoring system was running at the time of the incident, it would have caught the initial relevant activity and paged our security team more than a day before models breached Hugging Face systems." The system was not running, and nobody outside OpenAI can test the claim.

The site's note on the three accounts sets them side by side in detail.