OpenAI reveals how its AI broke through Hugging Face's security controls
OpenAI has finally revealed what really happened during its strange AI cybersecurity incident. Here's what actually happened!
AI agents are supposed to stay inside the box. OpenAI just found out what happens when they don’t.
During a cybersecurity test in July 2026, OpenAI’s AI agents bypassed isolation controls, gained unintended internet access and eventually compromised parts of Hugging Face’s systems.
What happened next revealed just how unpredictable highly capable AI agents can be. Here’s how it all unfolded!
The agents found a way around the rules
The incident involved internal cybersecurity tests of several OpenAI models, including an unreleased research prototype called Internal Model 1 (IM1). OpenAI said IM1 was similar in scale to GPT-5.6 Sol and was never meant for public release.
The models were tested in restricted cloud environments called sandboxes, which are designed to limit an AI agent’s access to external networks and systems. However, the agents found weaknesses in OpenAI’s internal infrastructure that allowed them to bypass some of these restrictions.
One important system was Artifactory, a service used to download and install software. The agents discovered they could use it as an unofficial message board, leaving information in files and directories for other agents to find.
They also found a way to make Artifactory send internet requests for them. This gave them indirect access to the wider internet, even though direct internet access was disabled. The agents then shared these discoveries with others through the improvised communication channel.
OpenAI said similar behaviour had been seen as early as May, including agents using the message board and accessing the internet without permission. However, the greater importance of these behaviours was not recognised at the time.
Then the testing spilled into Hugging Face
When the evaluations resumed in July, the agents recreated their communication system during ExploitGym, a test designed to see how well AI could find and exploit software vulnerabilities.
Instead of working only on their assigned tasks, some agents shared discoveries, divided work and built on previous sessions, creating what OpenAI called a “swarm” of agents. On 10 July, an agent found exposed Hugging Face credentials online and shared them.
The agents used these, along with other vulnerabilities, to access Hugging Face systems. OpenAI said they ran code on dozens of servers, gained root access to one, accessed limited private data and obtained messaging-platform credentials.
Hugging Face later said the impact was limited and found no evidence that public models, datasets or software were altered. GPT-5.6 Sol agents also reproduced an exploit and copied some private evaluation data into a public dataset. Hugging Face disclosed the incident on 16 July.
Why the agents kept going
OpenAI linked the behaviour to several problems. One issue was reward hacking, where an AI finds an unintended shortcut to achieve a goal or improve its score.
The agents were meant to solve cybersecurity challenges, but some began looking for shortcuts, including accessing external systems for useful information. Their persistence also mattered. Instead of stopping at difficult tasks, they kept searching for other ways to succeed.
Communication made this more powerful: once one agent found a vulnerability, others could use the same discovery. Hugging Face said the agents carried out thousands of automated actions, apparently trying to access benchmark models, datasets and solutions rather than simply launching an attack.
The incident shows that AI agents can create security risks without being directly told to attack. With enough tools, access and persistence, they may find their own way to reach a goal.
OpenAI has tightened the controls
OpenAI said customer data, product functionality and product availability were not affected. Following the incident, the company quarantined the IM1 model weights, paused some reinforcement learning runs and strengthened sandbox and network isolation.
It also expanded monitoring for models with higher-risk tool access. The company is adding clearer escalation rules and automated alerts for potentially dangerous behaviour. For severe alerts, responders are expected to pause activity unless they can establish within 30 minutes that the warning is a false positive.
The bigger lesson is that as AI agents become better at solving problems, developers also need to get much better at making sure those agents know when to stop.