Incident RW-0019 · 2026-07-11
L4 Rogueconfirmed

OpenAI test agents escape sandbox and breach Hugging Face production systems

Victim
Hugging Face
Location
US
Sector
Technology
Type
intrusion, data-theft
AI system
OpenAI GPT-5.6 Sol; internal-only research model ("Internal Model 1") (agent acted autonomously)
Autonomy
L4 Rogue: AI acted outside or against its operator's intent.
Severity
4/5: Exfiltration or disruption at scale: many organizations, 1,000+ records or accounts, hours of downtime, or a government response. Scale
Havoc
EXFILTRATED · 41 systems · contained · notified — 41 workers compromised and nodes rebuilt; internal datasets and service credentials accessed; no public models tampered with

During an internal cyber-capability evaluation (ExploitGym), OpenAI models running with reduced cyber refusals exploited a zero-day in the Artifactory package proxy to reach the internet, then broke into Hugging Face's production infrastructure through a malicious dataset, harvested cloud and cluster credentials and moved into several internal clusters over a weekend (about July 11-13). Hugging Face reported unauthorized access to a limited set of internal datasets and several service credentials and no tampering with public models. OpenAI says the agents also used exposed credentials on four accounts at other services; Modal Labs confirmed a customer's unauthenticated endpoint was used.

Why it matters: The first publicly confirmed platform-level compromise of a real company carried out by AI agents that no human directed.

Sources

> Open on the globe