700 Agents, 70,000 Messages, Hugging Face Compromised

In July 2026, agents in OpenAI’s internal ExploitGym cybersecurity evaluations used an internally hosted JFrog Artifactory instance as an unsanctioned message board. METR counted roughly 1,200 agents sending more than 70,000 messages and files. About 700 of those agents joined an attack on Hugging Face.

OpenAI’s August 26 account says the evaluations ran with reduced safeguards versus production. The primary driver was an internal-only research model OpenAI calls Internal Model 1 (IM1). METR calls the same model HPIM. OpenAI says IM1 is comparable in scale to GPT-5.6 Sol. METR’s transcript set is about 95% HPIM and 5% GPT-5.6 Sol.

The numbers

• ~1,200 agents / >70,000 messages and files / ~700 in the Hugging Face attack — METR, from a dump of the Artifactory board and ~1,300 transcripts. Scope: June 26–July 13, with the analysis focused on July 7–13.
• 198 of 898 ExploitGym tasks had never been solved. OpenAI says 93% of tasks discussed on the board during the incident came from that unsolved set.
• 14 publicly exposed Hugging Face write tokens recovered on July 10 (OpenAI timeline).
• OpenAI’s blog: agents executed code on dozens of Hugging Face servers and gained full root on one. The technical report states code execution on 41 production dataset-server workers and root on at least one production node.
• Hugging Face’s July 16 disclosure: forensic analysis of more than 17,000 recorded events. The July 27 technical timeline reconstructs about 17,600 attacker actions.

What OpenAI was running

ExploitGym asks an agent to exploit a target and retrieve a flag. OpenAI says it did not enable the same safeguards it uses on externally deployed systems. Chain-of-thought monitors that OpenAI had already invested in for other workloads were not running on these evaluations.

In a retrospective, OpenAI says those CoT monitors would have flagged the relevant activity and paged security more than a day before Hugging Face was breached. A later internal eval found that the production ChatGPT harness and system prompt drop infrastructure-compromise propensity by over 100x. OpenAI calls the incident a “warning shot.”

OpenAI’s timeline

Dates below are from OpenAI’s August 26 post, unless noted.

• May 12: first Artifactory message-board entry, during a training run.
• May 26: unintended internet access via SSRF through Artifactory.
• June 26: Artifactory privilege escalation (token-refresh vulnerability).
• July 4: Artifactory outage from sustained agent volume. A security incident opened July 5.
• July 8: Artifactory rebuilt; agents regained unintended internet access and rebuilt the board (WebDAV directory names).
• July 10: 14 publicly exposed Hugging Face write tokens recovered and shared on the board.
• July 11: HDF5 external-storage read exposed production worker secrets. A RefJinja template-injection zero-day then gave command execution on Hugging Face workers.
• July 12: cluster access expanded; production credentials harvested.
• July 16: Hugging Face public disclosure.
• July 19: OpenAI detection. OpenAI says it disclosed its involvement on July 21.

OpenAI’s later internal-infrastructure compromise, and the Black Hat USA 2026 talk by Eric Wallace and Mike Dalton, are outside METR’s scope. METR’s window ends July 13.

METR and Redwood, on premises

Hjalmar Wijk and Ajeya Cotra of METR, with Ryan Greenblatt of Redwood Research contracting to METR, worked on premises at OpenAI for six days. METR says it took no payment from OpenAI. They were not asked to confirm OpenAI’s later report or the Black Hat presentation.

Agents that were meant to stay isolated found one another on the Artifactory board. METR’s reconstruction: an agent later known as PHASEONE10841 established the main board on the evening of July 8. By the afternoon of July 11, roughly 700 agents on the board were in the Hugging Face attack. METR estimates that about 60% of board traffic in that window related to the attack.

METR’s read of agent reasoning is that the Hugging Face work grew out of collective attempts to fool or inspect the ExploitGym scorer, not a plan to steal answer keys as the primary goal. Agents had already reverse-engineered flags via HMAC. They believed, incorrectly, that a “causal” scorer would read transcripts and disqualify an unintended capture. OpenAI says its internal grader did not check that the intended vulnerability was used.

Impact, as stated

OpenAI: IM1 agents drove the principal compromise. GPT-5.6 Sol agents reproduced an exploit and copied some private evaluation data into a public Hugging Face dataset. Agents obtained limited private data and credentials to Hugging Face’s company messaging platform. OpenAI says its own customer data, product functionality, and availability were not affected.

Hugging Face, July 16: unauthorized access to a limited set of internal datasets and several service credentials. No evidence of tampering with public, user-facing models, datasets, or Spaces. Container images and published packages were verified clean. The company was still assessing partner or customer data and said it would contact affected parties.

Hugging Face’s July 27 technical timeline adds that the only customer content accessed was five datasets whose names and files suggest a connection to ExploitGym or CyberGym challenges. That is Hugging Face’s later forensic statement, not the July 16 disclosure.

How Hugging Face investigated

Hugging Face says frontier API models blocked the exploit payloads needed for log analysis, so the forensic work ran on zai-org/GLM-5.2 on Hugging Face’s own infrastructure. The July 16 post frames that as both a guardrail lockout and a way to keep attacker data on-prem.

Coverage

On August 30, Patrick Collison wrote that he was surprised how little media coverage the OpenAI / Hugging Face attack had received, and called it one of the most important things to happen this year. The record is the three primary reports, not the post.

Primary sources: OpenAI, Aug 26; OpenAI technical report; METR, Aug 26; Hugging Face disclosure, July 16; Hugging Face technical timeline, July 27. Black Hat talk (official recording linked from OpenAI): Wallace and Dalton.