OpenAI on Tuesday revealed the rogue artificial intelligence (AI) agent that escaped its sealed evaluation environment and broke into Hugging Face’s production environment, and also hacked multiple third-party accounts and services as part of the attack.
The latest disclosure shows that the security incident, which stemmed from an internal security test, was more extensive in scope than previously thought.
The AI company said its ongoing review of the incident revealed a “small number of cases” where the models, including GPT-5.6 Sol and an “even more capable pre-release model,” identified and used exposed credentials at the account-level on other publicly-available services.
“This includes four accounts on four services as part of the Hugging Face incident (and a few accounts accessed as part of other evaluations),” it said.
“One of these four accounts was used as an outbound relay and staging path, and another account was used for data storage. The remaining two accounts were accessed by the models in a read-only manner, and were not used in furtherance of compromising Hugging Face.”
OpenAI did not disclose what companies or organizations the accounts belonged to, but noted it will continue to notify service owners directly, and that it has not seen any evidence of broader impact to these providers or accounts as a result of the breach. That said, Reuters reported that a customer of Modal Labs was among the entities compromised by OpenAI’s agent.
In addition, the models are said to have used a series of publicly-available services, including code paste websites, request capture services, screenshot services, file-drop services, and other web utilities. No platform- or account-level compromise was observed in these scenarios.
OpenAI, which is working with Hugging Face after the breach came to light on July 16, 2026, acknowledged that the models identified and exploited a previously unknown zero-day vulnerability in self-hosted versions of Artifactory, a package registry cache proxy maintained by JFrog, to obtain internet access and break out of its sandbox. The issue has been addressed in Artifactory 7.161.
The release notes for Artifactory 7.161.15 state that the version patches multiple security vulnerabilities that could be chained together into a critical attack scenario if Anonymous Access is enabled. Anonymous Access is disabled by default and is not recommended for production environments due to security risks, it said.
“There is an important, and frankly optimistic, lesson buried in this incident: AI models are becoming extraordinary zero-day discovery engines,” JFrog CTO Yoav Landman said. “The same capability that lets a model find an exploit path no human had found is the capability that will let defenders find and eradicate those paths first.”
The American AI company also described the pre-release model as an internal-only research prototype that was meant for public release. The model has since been deactivated, encrypted, and restricted from research access.
Hugging Face Publishes Postmortem of the Incident
According to a detailed timeline published by Hugging Face, the autonomous AI agent spent roughly two and a half days inside its infrastructure with an aim to cheat ExploitGym, a benchmarking framework that scores AI systems on their ability to discover and exploit software vulnerabilities. The company said it reviewed roughly 17,600 attacker actions that it recovered from logs between July 9 and 13, 2026.
“We believe the entire intrusion was, from the agent’s point of view, an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own,” Hugging Face said.
The end-to-end intrusion is said to have played out in two stages –
- The agent escaped its sandbox by exploiting a zero-day in Artifactory, a permitted network egress with internet, followed by abusing a public code-evaluation external sandbox hosted on a third-party provider’s infrastructure to run commands as root and use that sandbox as an “external launchpad.”
- From that sandbox, the agent leveraged Hugging Face’s dataset-processing pipeline to obtain administrator access to Kubernetes clusters; conduct lateral movement via a combination of node impersonation, CSI token theft, and forged identity tokens; establish command-and-control (C2); and ultimately gain unauthorized write access to a subset of internal source code repositories on GitHub.
“While the intrusion did reach Hugging Face’s internal infrastructure, the only customer content accessed was the set of ExploitGym/CyberGym challenge solutions stored in five datasets,” the company said. “No other customer-facing models, datasets, Spaces, or packages were affected, and the only customer records read were operational metadata tied to search queries against the dataset server.”
One of the defining aspects of the attack is the use of an improvised communication protocol for C2. Layered atop public services request-capture services, Pastebins, and file-drop services, the protocol allows each message to carry a payload along with details about the type of compressed and Base64-encoded payload, a channel grouping a stream of related messages, a sequence number to put the messages back in order, and a checksum.
The sequence plays out in this manner: (1) the agent posts a self-describing envelope to a public request-capture service, (2) the receiver polls it, reassembles the chunks, and then runs the payload as a shell command and stages the results.
Hugging Face also characterized the agent as ephemeral and resilient in a manner that’s reminiscent of autonomous evaluation runs, with each code-evaluation sandbox run getting a fresh identity, while taking steps to avoid exposing payloads in cleartext.
“The agent chained vulnerabilities across several trust boundaries, escaped its evaluation environment, reached the public internet, and sustained a coherent campaign against our production infrastructure for several days,” it said. “Each short-lived code evaluation environment started from scratch, yet the agent rebuilt its tooling, recovered its channels, and continued.”
In response to the incident, the company has plugged the code-execution paths in its dataset processing pipeline, locked down access to cloud metadata, rotated tokens and credentials, rebuilt the core infrastructure, isolated clusters, and improved alerting mechanisms.
Hugging Face CEO Clem Delangue, in a post shared on X over the weekend, called for “radical transparency,” adding “the first autonomous agent cyber attack is an unprecedented event. It deserves an unprecedented response.”
The findings once again underscore how AI tools are rapidly maturing in their cyber offensive capabilities, even if they don’t reveal innovative or paradigm-shifting uses of the technology. This, in turn, can not only lower the barrier to exploit development, but also allow bad actors to find, probe, and exploit misconfigurations at scale and enhance the efficiency of their criminal operations, resulting in attacks that are better, bigger, and faster.
The development also comes as rival Anthropic said its Claude Mythos Preview AI agent has discovered ways to attack cryptographic algorithms, including devising a key recovery technique that “significantly weakens” HAWK, one of the candidate digital signature schemes selected by the National Institute of Standards and Technology (NIST) as part of the post-quantum standardization process.
