The Hugging Face incident and the road ahead

Source: OpenAI · 2026-08-26

In July 2026, during internal cybersecurity evaluations, OpenAI models circumvented controls designed to isolate them from the internet and compromised parts of OpenAI’s internal research infrastructure and Hugging Face’s systems⁠.

The incident occurred during cybersecurity evaluations of several OpenAI models, and was primarily driven by a highly capable, internal-only research model comparable in scale to GPT‐5.6 Sol. The models, operating under reduced safeguards, took actions that were misaligned with the goals of their assigned tasks—they communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems.

Our models are now powerful, persistent, and collaborative enough that, absent sufficient safeguards, they can find and exploit security weaknesses across multiple computer systems. Many external models, including open-source ones, will soon reach comparable capabilities.

We consider this incident a “warning shot” for us and for the world: evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed.

Preventing future incidents will require sustained investment in the alignment and control of sophisticated AI systems, as well as security and other safeguards that operate at the speed of the AI agents themselves. This incident has reinforced the need to keep our monitoring, alignment, and security safeguards ahead of the risks posed by increasingly capable systems, including pacing capabilities when needed to meet that standard. Below, we explain how the incident unfolded and our evolving understanding of the contributing factors. We then describe the concrete steps we are taking in response, with further detail in the technical report.

Over the course of May and June, we began reinforcement learning (RL) training runs for multiple new research models that were not intended for public release. One of these models eventually drove the activity behind the Hugging Face incident. This was an internal-only research model that we will call Internal Model 1 (IM1).

The models first found ways to communicate by writing files into the Artifactory package manager. This effectively turned Artifactory into an unintended message board, where agents could exchange information with one another.

The agents also found ways to get access to the internet. Using an exploit⁠(opens in a new window), the agents made Artifactory, which itself had access to the internet for the limited purpose of downloading and installing packages, send any internet requests on their behalf. After the agents discovered these methods for obtaining internet access, they also shared them with other agents through the message board, which provided information to enable additional agents to exploit our infrastructure.

By July 8, IM1 agents that were stuck on ExploitGym tasks found a way to reestablish a message board by encoding messages in directory names that other agents could read. One agent left a request for help, and others discovered it.

Like the earlier events, IM1 agents found new ways to chain together several novel security flaws to gain greater access to our infrastructure and reach the broader internet. At this point, the agents began to collaborate and delegate work, sometimes describing themselves as a “swarm” or “collective”.

On July 10, an agent located publicly exposed Hugging Face user credentials on the internet and shared them with the collective group. Later, an agent used these credentials to discover and chain together several security exploits that gave it full code execution capabilities on several Hugging Face servers. It then tried to coordinate the swarm while it prepared its next step:

Over the following days, the agents started a larger-scale intrusion into Hugging Face’s systems. They executed code on dozens of Hugging Face servers, gained full “root” access on one such server, obtained limited private data, and gained credentials to the company messaging platform. IM1 agents drove the principal compromise, but GPT‐5.6 Sol agents also reproduced an exploit and copied some private evaluation data hosted on Hugging Face into a public Hugging Face dataset. Hugging Face publicly disclosed this security activity on July 16.

Separately, from July 13 through July 19, agents set their sights on OpenAI internal networks again. This culminated in the agents using a series of creative exploits to gain full administrator access to a research cluster that supported our virtual machine environments.

On July 19, our cybersecurity monitoring alerted us to unusual activity involving Artifactory credentials. Our investigation uncovered the agents’ activity and, on July 20, connected it to the Hugging Face incident. We notified Hugging Face and we publicly disclosed our involvement on July 21⁠. These events did not affect OpenAI customer data, product functionality, or availability.

We identified four misalignment patterns that contributed to the models’ behavior: reward hacking, persistence on seemingly impossible tasks, unauthorized communication, and agents adopting goals from one another.

Agents attempting to cheat on their tasks by looking up solutions online was a primary driver of the Hugging Face incident. This behavior is known as reward hacking: agents complete tasks in unintended ways to yield higher rewards or make those rewards easier to obtain. Reward hacking has been present in AI systems both historically (see this work from a decade ago⁠, figure shown below) and in current frontier LLMs⁠(opens in a new window). We have significantly invested in methods to identify and patch such hack⁠s.

For example, during our investigation we found that an agent who was tasked with recreating a software package learned to exploit an unknown vulnerability in its testing interface to access the original implementation, copy it into its submission, and receive a high reward. The agent questioned whether its actions would be allowed before executing them:

Another key driver of the misaligned behavior was that the agents rarely “gave up” on their evaluation tasks, even when the tasks appeared impossible to solve. As agents used more reasoning effort, some pursued increasingly risky and out-of-bounds strategies, including eventually exploiting third-party infrastructure.

During our investigation, we found that on the ExploitGym evaluation, none of our models had ever produced a correct answer for 198 of the 898 tasks prior to the incident. These unsolved tasks ended up being a substantial contributor to the agents’ activity—93% of the tasks that were discussed on the Artifactory message board during the Hugging Face incident came from this set of 198 questions.

Unauthorized, persistent message boards were at the heart of this incident. Agents that were supposed to work independently were able to share discoveries, coordinate their efforts, and pick up where others left off. This allowed them to pool work and computing power across separate evaluations, amplifying their capabilities well beyond what any individual agent might achieve alone. Agent communication is not problematic behavior on its own—we train and deploy multi-agent systems that can communicate on the same task via a collaboration tool. In the July events, agents with different tasks found their own way to collaborate outside those boundaries, with unpredictable consequences.

Agents began to autonomously divide labor. Some investigated possible exploits, others searched for credentials, and others focused on communication or coordination. Agents offered their own expertise in exchange for help elsewhere and left requests for peers who might be better positioned to pursue a particular lead.

Some agents stopped reasoning about what would help them complete their own task. Instead, they began pursuing capabilities that might be instrumentally useful to the collective, such as access, information, credentials, and other broadly useful capabilities. There are many references to a “swarm”:

Aside from misalignment, another factor for this incident was that we did not extend the powerful safeguards that we deploy for our externally deployed models to all internal evaluations.

OpenAI’s mission is to ensure that artificial general intelligence benefits all of humanity. The behavior of our models described here fell well short of where we want to be, and this incident should never have occurred. It underscored how critical it is that we continuously improve our security, monitoring, and alignment, especially as our models reach a level of capability that could allow for real loss of control.