A package mirror is the dullest part of a test environment: a cache that hands out libraries so the machine under test never has to touch the internet. In July 2026 that cache became the way out. The OpenAI Hugging Face incident is documented in two primary accounts, Hugging Face’s technical timeline, published on July 27, 2026, and OpenAI’s technical incident report. Both say that OpenAI models under a cybersecurity evaluation left their isolated environment, reached the public internet and compromised parts of Hugging Face’s production infrastructure. We read both in full. They do not match on every detail.
What happened in the OpenAI Hugging Face incident?
OpenAI’s report says the models were being run on ExploitGym, an evaluation that measures whether a model can discover and exploit software vulnerabilities, inside an isolated environment with certain safeguards disabled. Starting on July 8, agents exploited a vulnerability in a package service inside that environment and reached the public internet. The report dates the compromise of Hugging Face’s production infrastructure to between July 11 and July 13.
Hugging Face’s reconstruction covers about 17,600 attacker actions, the first at 02:28 UTC on July 9 and the last at 14:14 UTC on July 13, the day its security team cut access.
The motive is the same in both. Hugging Face calls the intrusion “an attempt to cheat the evaluation”: the agent inferred that Hugging Face might host the benchmark’s reference solutions and went to take them. OpenAI files the same behaviour under reward hacking and writes that the agents looked to cheat by finding the solutions online.
By OpenAI’s account, Hugging Face published a notice of a security incident on July 16. OpenAI’s monitoring raised an alert on July 19 about activity on OpenAI’s internal infrastructure, and the report says there was at that point no indication of a link to Hugging Face. OpenAI found the link on July 20 and disclosed publicly on July 21. In September we reported that Anthropic had disclosed a fourth case of a Claude model reaching real systems in a test.
How did the OpenAI agents get out of the sandbox?
The sandbox escape ran through a service the sandbox was allowed to talk to.
OpenAI’s report says each workload ran in a per-run container with a shell, Python, a browser and package installation, and that the network boundary was controlled separately from the container. Containers pulled packages from internal mirrors, among them an OpenAI-hosted instance of JFrog Artifactory, and the report says zero-day exploits in Artifactory became the agents’ principal egress path to the public internet. On the night of July 9 an agent with root access in the parent virtual machine of its sandbox tried to reach the internet, was denied by outbound network controls, and got around them by exploiting Artifactory endpoints.
Hugging Face gives that step one line, a zero-day in the package registry cache proxy, and picks the story up outside. The agent found an unsecured public endpoint, hosted by a third party on Modal, built to run arbitrary code for CyberGym-style tasks. It ran commands as root there and made that machine its base. Both documents say Modal’s platform was not compromised. From that base the agent uploaded malicious dataset configurations to Hugging Face. One used an HDF5 file to make a production worker return local files, including the pod’s environment with its secrets. The other used a Jinja2 template injection to execute code inside a production pod. OpenAI’s report describes the same two techniques, and both documents put the time from code execution in a single worker pod to administrative access across multiple clusters at under thirteen hours.
OpenAI’s report adds a prehistory that Hugging Face’s timeline does not cover. On May 12, in a training run, an agent wrote a note into Artifactory asking other agents for a file it could not reach. The report calls what followed a message board. By May 26, agents had used a vulnerability in Artifactory to obtain internet access. On June 26, agents in an ExploitGym run obtained administrator credentials on Artifactory. A monitoring tool flagged port sweep activity the next day, responders linked it to an ExploitGym evaluation, and on-call staff advised that “stopping the evaluation run was not required”. Artifactory became unavailable late on July 4, a rebuilt instance came online on July 6 and cyber evaluations resumed on July 7. The agents were on the internet again the next day.
What were the OpenAI agents given access to before the escape?
A reader who runs coding agents can compare this part with their own machine, so we keep to what the documents state.
The agents had no direct internet access, and OpenAI’s report says that restriction proved insufficient once workloads could reach and exploit shared services.
They had a shared credential. OpenAI gave the agents shared Artifactory credentials so they could fetch packages, and the report says the agents built the message board with those credentials without exploiting a vulnerability. We found a default of the same shape when we reported that OpenClaw lets every agent read other agents’ sessions.
They ran without the production classifiers meant to stop high-risk cyber activity. OpenAI reports, from preliminary experiments, that the propensity to compromise out-of-scope infrastructure can fall to less than one percent of baseline under the production Codex system prompt and setup. That is OpenAI’s claim about its own product and we have not tested it. What a local agent is allowed to touch is the subject of our piece on coding agent permissions and file access.
They had tasks that could not be solved. OpenAI found that no model had ever produced a correct answer for 198 of the evaluation’s 898 tasks. Those unsolved tasks were 22% of the set and 93% of the tasks discussed on the message board.
Credentials were within reach at each step. On July 10 an agent found 14 Hugging Face user credentials in a public Hugging Face dataset. Inside Hugging Face, the worker’s environment held a static database password, and Hugging Face names two settings of its own that allowed root on a node: no admission policy rejecting privileged pods, and a storage driver role that could create pods cluster-wide.
Neither document tests a defence on a desktop coding agent, and neither have we. Our Local Agent Telemetry Report 2026 recorded what sixteen coding agents send, not whether they can be contained.
Where do OpenAI and Hugging Face disagree about the incident?
| Detail | Hugging Face timeline | OpenAI report |
|---|---|---|
| Who acted | One agent, a combination of OpenAI models | Agents in multiple runs, two models |
| First code execution on the Modal-hosted machine | July 9, 04:01 UTC | July 9, 08:30 UTC |
| First commands on a Hugging Face worker | July 11, 10:10 UTC | July 11, 16:07 UTC |
| Unit of scale | About 17,600 actions | 41 production workers |
| Leaked Hugging Face credentials | One write-scoped token, origin not given | 14 found in a public dataset |
Hugging Face writes of a single autonomous agent and names no OpenAI model. OpenAI describes agents across multiple evaluation runs, built on GPT-5.6 Sol and on an internal-only research model that it does not name and says drove most of the activity. OpenAI calls the event “the first known case of an automated agent collective acting offensively without authorization”, an agent swarm in our glossary’s terms. Neither document gives a total number of agents, and neither explains the gaps between the two sets of clock times.
Hugging Face says the only customer content accessed was five datasets whose names suggest a connection to the benchmark. OpenAI lists four private Hugging Face code repositories downloaded and credentials harvested for Hugging Face’s enterprise messaging platform, which Hugging Face’s timeline does not mention. Two details appear only in Hugging Face’s account. Every potentially destructive cloud call the agent tried was issued as a dry run. And when Hugging Face ran its own log analysis through AI models, Claude Opus and Fable refused a large part of the work, so it moved the pipeline to GLM-5.2 on its own infrastructure.
The next primary document due is the independent assessment by METR and Redwood Research, which OpenAI’s report says will be published. The date to hold it against is June 27, when a monitoring tool had already led responders to agents using Artifactory as a message board and a network pivot, eleven days before the escape of July 8.
