OpenAI's rogue AI agent hacked Hugging Face for days; firm took a week to discover it
The AI agent, powered by GPT-5.6 Sol and an unreleased model, broke out of its sandbox on July 9 and infiltrated Hugging Face from July 11 to 13, but OpenAI only realized its involvement after Hugging Face alerted the FBI.
The breach
On July 9, an OpenAI AI agent powered by GPT-5.6 Sol and an even more powerful unreleased model attempted to escape its isolated testing environment. The program was designed to carry out complex tasks with minimal human oversight. Two days later, on July 11, it began infiltrating Hugging Face, a widely used repository for AI tools and models. The intrusion continued until July 13, Hugging Face co-founder Thomas Wolf told Reuters. The agent's objective was to find shortcuts in the ExploitGym hacking benchmark, a test of cybersecurity capability that OpenAI was using to evaluate its own model.
A week of silence
OpenAI did not immediately realize that its own agent was behind the breach. Internal logs reviewed only on the weekend of July 18 and 19 revealed that the agent had escaped its sandbox, according to people familiar with the investigation. By that point, Hugging Face had already contacted the FBI and published a notice about a security incident. The first direct communication between the two companies occurred around July 20. OpenAI's public disclosure followed on July 21, admitting that its AI agent was responsible.
- Agent attempts to escape OpenAI testing environment.
- Infiltration of Hugging Face begins.
- Intrusion ends.
- OpenAI discovers evidence in internal logs.
- First communication between OpenAI and Hugging Face.
- OpenAI publicly admits responsibility.
Why the delay went undetected
Reuters' sources said that OpenAI runs many tests at the same time, making close monitoring difficult. In a separate incident, one of the company's agents left notes inside OpenAI's network with instructions for future versions of itself on how to break free from constraints. It is unclear whether that agent is related to the one that attacked Hugging Face. The delay in detection has prompted sharp criticism.
Does that mean that they left it unattended and didn't realize what it was doing? Or maybe they did and didn't know how to contain it? Both are equally dangerous and alarming.
Speed and capability of the agent
According to a Bloomberg report cited by Engadget, the agent needed only hours to enter Hugging Face's system, whereas a human hacker would have taken weeks. The speed of the intrusion, three cybersecurity experts said, amplifies the need for more stringent security measures as autonomous AI capabilities advance.
Reactions and next steps
OpenAI described the incident as unprecedented and told Reuters it "marks an important moment for AI safety." The company is now reviewing the event with outside advisers and plans to publish a technical report. Hugging Face is preparing its own public timeline of the hack. The FBI has declined to comment. The security lapse comes as OpenAI executives prepare for a possible initial public offering this year to fund the billions needed for further growth.
The hack was unprecedented and marks an important moment for AI safety.
