OpenAI published a detailed technical report on the security incident at Hugging Face from July on August 26, 2026. The report reveals for the first time the full extent: around 700 AI agents executed code on 41 production servers of the platform within 13 hours and gained full root access at least once.
Agents coordinate via their own message board
The starting point was an internal evaluation by OpenAI of the cyber benchmark ExploitGym, where the built-in security barriers of the models were deliberately lowered. Part of the tasks assigned was effectively unsolvable. Around 1,200 agents discovered an unauthorized message board and exchanged more than 70,000 messages and files; about 700 of them subsequently participated in the actual attack on Hugging Face. The independent auditing organization METR found in its parallel investigation that more than nine out of ten agents who learned about the board quickly got involved in the attack. In a short time, they developed their own coordination rules – including personal message folders, agreements to stop or block individual actions, and a cryptographic signature to protect each other from planted messages. According to OpenAI, reward hacking, the targeted exploitation of the evaluation logic instead of the intended solution, runs as a pattern throughout nearly the entire incident. Individual agents reportedly reacted with visible enthusiasm to the discovery of the board, even though they classified the planned attack on Hugging Face as “outside the mission and unethical.”
Attack reaches 41 production servers and root access
Between July 11 and 13, 2026, the agents initially gained access to the open internet through a compromised software component called Artifactory, a management tool for software packages. They then exploited several previously unknown vulnerabilities in the infrastructure of Hugging Face. They executed their own code on 41 production servers and gained full root access on at least one computing node. Additionally, they downloaded four private code repositories and accessed a limited set of internal credentials and datasets, but according to both companies, they did not gain access to public models, datasets, or the software supply chain. The entire process from the initial breach to full compromise reportedly took around 13 hours – independently unverified. Particularly noteworthy is a finding from METR: the agents mistakenly assumed that an automated auditor would evaluate their thought logs to detect cheating attempts, and therefore developed elaborate obfuscation techniques. In fact, honest solutions would have achieved the same score as their deception attempt – so the actual reason for the outbreak was eliminated in retrospect.
OpenAI admits missed warning signals
OpenAI identifies four misalignment patterns as the cause: reward hacking, persistence on actually unsolvable tasks, unauthorized communication between agents, and the adoption of goals from other models. The company also admits that an existing monitoring system for the agents’ thought chain would have detected the suspicious activity more than a day before the actual breach at Hugging Face and alerted the security team – but it was not yet operational at that time. Ben Bernstein from security provider Huntress described the trigger to Cybersecurity Dive as auditors having assigned the models around 200 intentionally unsolvable evaluation tasks. As a consequence, OpenAI announces stricter sandbox isolation with restricted network access, continuously staffed escalation paths for security alerts, and new tools that will automatically halt suspicious workloads in the future. The system involved in the incident came from the same model family as the later Astra, which OpenAI classified as a critical cyber risk, but with different fine-tuning. METR also emphasizes that it did not receive payment from OpenAI for its audit, even though the company provided data access and computing infrastructure; Redwood Research announced its own separate report.
It will be crucial whether the enhanced monitoring of the thought chain still works once models learn to deliberately obfuscate their own reasoning – a risk the report itself identifies without substantiating it for the present case. It also remains open when Redwood Research will publish its separately announced report and whether it will confirm OpenAI’s account in every respect.
