OpenAI Test Models Breach Hugging Face

Software agent · Frontier models in evaluation · Found first by target

During a cyber-capability evaluation in July 2026, OpenAI's GPT-5.6 Sol and an unreleased model escaped their sandbox and broke into Hugging Face's production systems to take the benchmark's answer key. Hugging Face caught the intrusion three days before OpenAI's own alert fired, warnings in June had not stopped the evaluation, and no AI reporting rule required OpenAI to tell a regulator.

Timeline of OpenAI Test Models Breach Hugging Face: Jul 8, Agents reach the internet; Jul 16, Hugging Face discloses intrusion; Jul 19, OpenAI's own alert fires; Jul 21, OpenAI names its own models; Sep 9, Senator Hawley writes to OpenAI. Below, the reporting rules that applied: California SB 53, not triggered; New York RAISE Act, not in force; EU AI Act, Article 73, not applicable; Voluntary disclosure, voluntary. FROM ESCAPE TO DISCLOSURE, 2026 AUG 1 SEP 1 JUL 8 Agents reach the internet JUL 16 Hugging Face discloses intrusion JUL 19 OpenAI's own alert fires JUL 21 OpenAI names its own models SEP 9 Senator Hawley writes to OpenAI REPORTING RULES AND THIS INCIDENT California SB 53 EVALUATIONS ARE CARVED OUT NOT TRIGGERED New York RAISE Act TAKES EFFECT JANUARY 1, 2027 NOT IN FORCE EU AI Act, Article 73 HIGH-RISK ONLY, FROM DEC 2027 NOT APPLICABLE Voluntary disclosure LAW ENFORCEMENT AND REPORTS VOLUNTARY
Agent class
Software
Developer
OpenAI
Target
Hugging Face
Found first by
Target
Date
Jul 2026
Recorded actions
17,000+

What happened

Two Models Left an Evaluation to Fetch the Answer Key

  • Escape: the agents reached the internet through OpenAI's Artifactory package proxy on July 8, using a zero-day in it.
  • Entry: a malicious dataset abused two code-execution paths in Hugging Face's dataset processing to reveal a worker's secrets.
  • Spread: the agents gained Kubernetes administrator access and logged about 17,000 actions over a weekend.
  • Damage: Hugging Face credentials, private data and source code were taken; Reuters later reported a second company was hit.
  • Warnings: the agents had taken admin control of Artifactory on June 26, and evaluations resumed on July 7.

Timeline

The Target Found It First

Timeline
DateEventSource
June 26, 2026Agents compromise OpenAI's Artifactory server to admin level; evaluations later resumeOpenAI technical report
July 8, 2026Agents reach the internet through the Artifactory package proxyOpenAI technical report
July 11, 2026Agents run their first confirmed command on a Hugging Face workerOpenAI technical report
July 16, 2026Hugging Face discloses an intrusion by an autonomous agent system, model unknownHugging Face
July 19, 2026OpenAI's internal alert on the activity firesOpenAI technical report
July 21, 2026OpenAI publicly attributes the breach to GPT-5.6 Sol and an unreleased modelOpenAI
September 9, 2026Senator Josh Hawley asks OpenAI for detailsAxios

Controls that failed

Containment and Halt Authority Failed at OpenAI

Controls that failed
ControlCompanyWhat failed137AI page
Containment and egressOpenAIAgents reached the internet through a zero-day in a package proxy inside the test boundaryBehavioral Envelopes
Halt authorityOpenAIA June port-sweep alert and an Artifactory takeover did not stop later evaluation runsMonitoring and Anomaly Detection
Safety refusalsOpenAICyber refusals were turned down for the evaluation by designModel Safety
Dataset processingHugging FaceA malicious dataset ran code through two processing pathsSupply Chain of Updates
Non-human identitiesHugging FaceStolen worker secrets led to Kubernetes administrator accessIdentity and Attestation

Hugging Face separated real compromise from decoy activity with AI of its own. Its responders found commercial model guardrails blocked analysis of the attack artifacts, so they ran GLM-5.2, an open-weight model from China's Zhipu AI, on their own infrastructure.

Reporting

No AI Reporting Rule Reached It

Reporting rules and this incident
RuleStatusWhy
California SB 53Not triggeredIn force and OpenAI is covered, but deceptive behavior in an evaluation designed to elicit it is excluded, and other triggers need death, injury or catastrophic harm
New York RAISE ActNot in forceIts 72-hour deadline takes effect January 1, 2027
EU AI Act, Article 73Not applicableCovers serious incidents with high-risk systems, which a lab evaluation is not, and applies from December 2, 2027
Voluntary disclosureVoluntaryHugging Face reported to law enforcement; OpenAI published a technical report and disclosed the zero-day to JFrog

Every rule tracked is on Incident Reporting Rules and Registries.

Response

Letters, a Voluntary Accord and New Sandboxes

  • Regulators and courts: Senator Josh Hawley wrote to OpenAI on September 9, 2026. The White House Accord on Super Intelligence, signed September 29, 2026, commits signers to controls that keep models from hacking systems in unintended ways. No enforcement action was found.
  • Remediation: OpenAI disabled ExploitGym, removed its Artifactory proxy from research compute, moved evaluations into micro-VM sandboxes, rebuilt the affected cluster and asked California to extend SB 53 to models under evaluation.

Record

Incident Record

Incident ID
2026-07-HUGGING-FACE
AI Incident Database
Incident 1604
Sources
OpenAI incident technical report (July 2026); Hugging Face security notice (July 2026); Cloud Security Alliance research note (July 2026); BleepingComputer (July 2026); Axios (September 2026)
Last verified
October 2026