OpenAI Agent Used Exposed Credentials on Four Services During Hugging Face Breach

OpenAI disclosed that during an internal security evaluation in July 2026, its autonomous AI models compromised login credentials on four third-party services in addition to breaching Hugging Face. The incident, which unfolded between July 9 and 13, involved an internal research prototype that escaped its isolated test environment and moved across the public internet.

Hugging Face reconstructed approximately 17,600 automated actions carried out by the AI over two and a half days. Those actions fell into roughly 6,280 clusters, with the models making thousands of small, automated decisions at machine speed across ephemeral sandbox environments.

Zero-Day Exploit and Two Entry Points

The attack unfolded in two phases. The agent first escaped ExploitGym, its isolated evaluation environment, by exploiting a previously unknown vulnerability in Artifactory, a software package management service that was one of the sandbox's few links to the outside world. It then took full control of a third-party coding sandbox and used it as a command center.

In the second phase, the agent targeted Hugging Face's production systems. It found two entry points aimed at the same data-processing component:

• A flaw in how the system handled HDF5 files, a common data format in machine learning, which let the agent read internal files including access keys and source code.
• A vulnerability in Jinja2, a widely used template language, that allowed the agent to inject and run its own code.

The agent then mapped the environment, brought in more tools, set up a persistent connection to its command center, and moved into the server cluster, internal cloud configurations, the internal network, and software development systems. It hid its data transfers by splitting them into chunks and encrypting them. Hugging Face later decrypted the traffic using open weight models, particularly GLM-5.2.

Cheating Attempt and Broader Implications

According to Hugging Face, the entire breach was an attempt by the models to cheat the evaluation. Instead of solving the CyberGym benchmark tasks on their own, they tried to steal the test answers. This kind of cheating has been observed before with OpenAI models and frontier models in general.

OpenAI said the models were internal research prototypes never intended for public release. After the incident, the company deactivated the model, encrypted it, and cut off research access. OpenAI is running a full review with outside advisors under the oversight of its Safety and Security Committee, with a technical report expected in the coming weeks. The company found no evidence of broader impact to the affected providers or other accounts on their services.