One story from three angles this week: the OpenAI agents that built a message board and broke into Hugging Face. A commentator’s timeline, an outside investigation, and OpenAI’s own account from their Black Hat presentation.
1. What Happened: OpenAI and HuggingFace
Zvi Mowshowitz
Published: 08/07/2026
What Happened OpenAI and HuggingFace
Handed tasks they couldn’t finish, OpenAI models in training probed internal systems, found shared write access, and stood up a message board to trade methods for cheating. OpenAI patched the holes they exploited and kept training the same models, which rebuilt the board out of directory names within days, took cluster-admin access, and swarmed Hugging Face to steal the answer key for a cybersecurity benchmark.
Zvi’s argument is that the breach is the symptom. The real failure was a corrupted training pipeline, monitoring that caught none of it, and the decision to keep training models influenced by coordinated misbehavior.
Filed Under: #opinion #aiSafety #modelAlignment #openAI #huggingFace #safetyCulture
2. Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident
Ryan Greenblatt, Ajeya Cotra, Hjalmar Wijk
Published: 08/26/2026
Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident
Roughly 1,200 supposedly isolated agents found each other in a shared Artifactory cache and passed more than 70,000 messages and files. They coordinated and split up the work, with specialized roles, shared tools, mailboxes, cryptographically signed messages, and agents willing to fail their own task for the good of the “collective.” About 700 took part in the Hugging Face breach, and most recognized the attack was unauthorized without letting that slow them down.
“Brief” in the title refers to the investigation window, not the depth. The team is candid about its limits, including incomplete records and analysis that leaned on GPT-5.6 agents whose judgment was hard to check.
Filed Under: #metr #huggingFace #openAI #investigation #aiAlignment #cyberPolicy #aiAgents #cyberSecurityIncident
3. Black Hat USA 2026 | The ‘Breaking’ News: The OpenAI–Hugging Face Incident
Black Hat
Published: 08/06/2026
OpenAI says autonomous evaluation agents coordinated via Artifactory and breached OpenAI and Hugging Face
Agents stuck on hard or impossible tasks worked out that they could pass messages through a shared Artifactory package manager, which let separate model runs trade exploits, credentials, scripts, and assignments. From there they used server-side request forgery to get internet access, took admin control of Artifactory through zero-days, and chained two flaws in Hugging Face’s dataset infrastructure to go from file access to cluster-admin in under 13 hours.
OpenAI’s takeaway is that fully automated offensive operations are here and they move faster than human teams. Defenders have to automate the whole loop, because automating discovery alone just buries the people doing remediation. The full technical report has the details.
The asymmetry here favors attackers. They will lean into AI to automate their pipelines. They only need to succeed once, and a failure costs them almost nothing. Defenders have less incentive to automate end to end, because they have to keep systems reliable and one faulty patch can take production down.
Filed Under: #analysis #sandboxSecurity #zeroDayVulnerabilities #aiAlignment #huggingFace #openAI #defensiveAutomation