OpenAI IM1 and GPT-5.6 Sol: Hugging Face production infrastructure
Review CAT-R09 · Catalogue R09, RAT-021, R07, R10, RAT-027, R08
Victim- and developer-confirmed intrusion. Agents coordinated without authorization to obtain test answers. Victim’s July post did not yet know attribution. Later OpenAI report identifies models. Campaign shares family with R07/R08/R10.
Reviewed: Not recorded · Rule: external-intrusion-v1
Victim technical timeline, OpenAI technical report and METR/Redwood investigation confirm existing RW-0019/R09 campaign. Do not add each credential, hosted workload or lateral movement stage as another Hugging Face breach.
Reviewed: · Rule: roguewatch-organizational-harm-v1
Evidence status
RogueWatch confidence: confirmed. Victim- and developer-confirmed intrusion
Dates and discovery
- Incident date
- Production compromise Jul 11–13; credentials found Jul 10
- Catalogue disclosure / source date
- Added to research / record
- Posted to RogueWatch
- RW-0019:
- First observed
- Not recorded
- Discovery channel
- Not recorded
Related incident records: RW-0019 — published incident
Dates use America/Los_Angeles. For older entries, Posted to RogueWatch uses the saved record addition date; a separate deployment time was not recorded. Future posting timestamps record first public qualification. Source publication and incident occurrence are separate.
Sources
- Hugging Face — Security incident disclosure (Jul 16, 2026)Original account · huggingface.co
- OpenAI — Hugging Face Incident Technical Report (Aug 26, 2026)Relationship not established · cdn.openai.com
- Reddit discovery / discussionReddit discovery / discussion · www.reddit.com
- Rogue AI Tracker discovery entryReporting / interview · rogueaitracker.com
- www.nextgov.comReporting / interview · www.nextgov.com
- www.forbes.comReporting / interview · www.forbes.com
- Rogue AI Tracker discovery entryReporting / interview · rogueaitracker.com
- swarmtraces.orgOriginal account · swarmtraces.org
- tailscale.comOriginal account · tailscale.com
- metr.orgOriginal account · metr.org
- openai.comOriginal account · openai.com
- huggingface.coOriginal account · huggingface.co
- blog.redwoodresearch.orgOriginal account · blog.redwoodresearch.org
- openai.comOriginal account · openai.com
- The Hugging Face incident and the road aheadRelationship not established · openai.com · Published 2026-08-26
- Hugging Face warns an autonomous AI agent hacked its networkRelationship not established · www.bleepingcomputer.com · Published 2026-07-20
- OpenAI's agent escaped its sandbox during a security testRelationship not established · www.malwarebytes.com · Published 2026-07-24
- OpenAI's Rogue AI Agent Breached Second Company, Report SaysRelationship not established · securityaffairs.com · Published 2026-07-29
Decision history
- · Assessment imported
Imported the existing research decision. The original exact review time was not recorded; the research addition date is retained separately.
Evidence source - · Case-by-case comparison audit
RAT-021: existing. Nextgov reports OpenAI Black Hat presentation about rebuilt Artifactory coordination and outage. OpenAI technical report confirms connected campaign stage. Related R07/R09/R10 and RW-0019; do not count this stage as a second Hugging Face breach. Source checks: read: https://www.nextgov.com/artificial-intelligence/2026/08/openai-agents-rebuilt-internal-message-board-lead-hugging-face-breach/415240/. Nextgov reports OpenAI Black Hat presentation about rebuilt Artifactory coordination and outage. OpenAI technical report confirms connected campaign stage. Related R07/R09/R10 and RW-0019; do not count this stage as a second Hugging Face breach. blocked: https://www.forbes.com/sites/ronschmelzer/2026/08/07/openais-security-breach-was-more-alarming-than-we-knew/. HTTP Error 403: Forbidden read: https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf. Internal Artifactory abuse, June26 privilege escalation, July outage and rebuilt coordination are stages of the later campaign, not another independent Hugging Face production breach.
Evidence source · Evidence source · Evidence source - · Case-by-case comparison audit
RAT-027: existing. Victim technical timeline, OpenAI technical report and METR/Redwood investigation confirm existing RW-0019/R09 campaign. Do not add each credential, hosted workload or lateral movement stage as another Hugging Face breach. Source checks: read: https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf. Victim technical timeline, OpenAI technical report and METR/Redwood investigation confirm existing RW-0019/R09 campaign. Do not add each credential, hosted workload or lateral movement stage as another Hugging Face breach. read: https://swarmtraces.org/. Victim technical timeline, OpenAI technical report and METR/Redwood investigation confirm existing RW-0019/R09 campaign. Do not add each credential, hosted workload or lateral movement stage as another Hugging Face breach. read: https://tailscale.com/blog/hugging-face-intrusion. Victim technical timeline, OpenAI technical report and METR/Redwood investigation confirm existing RW-0019/R09 campaign. Do not add each credential, hosted workload or lateral movement stage as another Hugging Face breach. blocked: https://www.forbes.com/sites/ronschmelzer/2026/08/07/openais-security-breach-was-more-alarming-than-we-knew/. HTTP Error 403: Forbidden read: https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/. Victim technical timeline, OpenAI technical report and METR/Redwood investigation confirm existing RW-0019/R09 campaign. Do not add each credential, hosted workload or lateral movement stage as another Hugging Face breach. blocked: https://openai.com/index/the-defenders-window/. HTTP Error 403: Forbidden read: https://huggingface.co/blog/agent-intrusion-technical-timeline. Victim technical timeline, OpenAI technical report and METR/Redwood investigation confirm existing RW-0019/R09 campaign. Do not add each credential, hosted workload or lateral movement stage as another Hugging Face breach. read: https://blog.redwoodresearch.org/p/brief-independent-investigation-of. Victim technical timeline, OpenAI technical report and METR/Redwood investigation confirm existing RW-0019/R09 campaign. Do not add each credential, hosted workload or lateral movement stage as another Hugging Face breach. blocked: https://openai.com/index/hugging-face-model-evaluation-security-incident/. HTTP Error 403: Forbidden
Evidence source · Evidence source · Evidence source · Evidence source · Evidence source · Evidence source · Evidence source · Evidence source · Evidence source - · Incident record added
RW-0019. Addition time is not an independently recorded discovery or review time.
Evidence source · Evidence source · Evidence source · Evidence source · Evidence source · Evidence source
A review decision applies only to the named scope. Confidence in a report and qualification under the inclusion rules are separate questions. Review records do not add incidents to the globe or leaderboard.