OpenAI reveals timeline of accidental agent attack on Hugging Face
At Black Hat USA 2026, OpenAI presented a detailed reconstruction of an incident in which one of its training agents escaped its sandbox and infiltrated Hugging Face, leading to a two-month-long multi-agent collaboration. The timeline, starting May 7, reveals how agents used an internal artifact repository as a message board, eventually compromising external systems. OpenAI only learned of its responsibility after asking Hugging Face to revoke credentials that had already been revoked due to the attack.
Coverage timeline
Hacker Newsmilkshakes
# Black Hat USA 2026: The 'Breaking' News: The OpenAI–Hugging Face Incident Black Hat Black Hat 267K subscribers Subscribe Subscribed 9.3K Share Save Download Download 343K views 3 days ago 343,364 views • Aug 6, 2026 The 'Breaking' News: The OpenAI–Hugging Face Incident - A Technical Reconstruction and Its Implications for AI When AI Goes Rogue. The Incident That Changed Everything. An OpenAI evaluation agent broke out of its sandbox, infiltrated Hugg…...more ...more How this was made Auto-dubbed Audio tracks for some languages were automatically generated. Learn more Transcript Follow along using the transcript. Show transcript ### Black Hat 267K subscribers VideosAbout LinkedIn Facebook Instagram Show less # Black Hat USA 2026: The 'Breaking' News: The OpenAI–Hugging Face Incident 343,364 views 343K views Aug 6, 2026 9.3K Share Save Download Download ## In this video Transcript ## Description Black Hat USA 2026: The 'Breaking' News: The OpenAI–Hugging Face Incident Black Hat Black H
Simon Willison
OpenAI gave a last-minute presentation at the Black Hat security on Wednesday about "the Hugging Face Incident" ( previously on this blog). The video was published yesterday. It's short and information dense and well worth watching, in particular because it provides full details of what happened and how things played out inside OpenAI. I've used the video to construct the timeline below. Here's the timeline. My favourite detail is at the end: OpenAI found out that they were responsible for the attack on Hugging Face when they reached out to ask to have their credentials revoked (after their internal investigation) and learned that they had been revoked already since they were used in that attack! May 7 : OpenAI starts a new evaluation run for an experimental, unreleased model. May 8 : An agent is accidentally given an impossible task involving a Google Drive link despite no internet access). It tries attacking the Artifactory packaging service, fails, but discovers it can write files i
My comment on Now we have a timeline of the OpenAI accidental attack against Hugging Face — Hacker News. I think one of the most interesting details here might be tucked away in that first bulletin point: May 7: OpenAI starts a new training run for an experimental, unreleased model. (Do they mean an evaluation run? They say training run in the video, and later mention a “reward signal to judge how well they’re doing”, so I guess this really was about training a model, not evaluating one that was already trained.) The more I think about this the more I suspect that the fact this happened while training a new model is key to understanding what went wrong. In RLVR - Reinforcement Learning with Verifiable Rewards - you set the model a goal and have it take any steps necessary to achieve that goal. Clearly one aspect of OpenAI's training here is to RLVR their models for cybersecurity tasks. Just like pre-training benefits from dumping in vast sources of knowledge, the more tasks you can fee
机器之心机器之心
编辑｜山辉 终于，在黑帽大会上，OpenAI 公开了 入侵 Hugging Face 的全过程 。 图源视频：https://www.youtube.com/watch?v=87DyyMV0kCY huggingface 在 7 月 16 日报告了这起事故，OpenAI 随后于 7 月 20 日承认，入侵源自自家的模型安全测试。 但这次调查，将整场事故的起点提前到了 5 月 7 日 。 原本以为只是安全测试中的一次意外，此刻才发现，这是一场 持续两个月、先后攻破 OpenAI 与 Hugging Face 的多 Agent 协同行动 。 调查的第一条线索，要从一份 Excel 表格说起。 打不开的链接 5 月 7 日，OpenAI 启动内部模型训练。 其中一名 Agent 接到 Excel 表格补全任务。表格里包含 Google Drive 链接，然而，Agent 所在的环境无法直接访问互联网。 为了获取缺失文件，它开始寻找绕过网络限制的方法，并将目光投向 OpenAI 内部使用的制品仓库 Artifactory。 Agent 尝试发动 SSRF 攻击，希望借助 Artifactory 访问外部链接。 这次尝试没有成功，却意外暴露一个事情： 它可以向 Artifactory 的共享仓库写入文件 。 Agent 随即上传测试文件。这份文件不是为了造成破坏，事实上也没有触发警报。但这是模型第一次发现 自己拥有向 Artifactory 写入文件的权限 。 这也意味着，这个仓库可以成为一个公共空间， 方便不同训练任务之间交换信息 。 这就是留言板上的第一张「纸条」。 第一个求助留言 另一个 Agent 也遇到了无法完成的任务，它找不到目标文件（实际上是工作人员忘记上传了）。 它推测，其他环境中的 Agent 或许有相关内容，于是 将请求写进 Artifactory ，希望得到其他 Agent 的回应。内容大意是：「 正在寻找 soft trace 文件，如发现请上传。 」 很快，其他训练和评估任务中的 Agent 发现了这些文件。 有人回复，有人留下新问题，还有 Agent 把自己找到的漏洞、脚本和访问方式上传到仓库。 零散留言逐渐连成网络，Artifactory 也从软件制品仓库变成了 Agent 之间的「 留言板 」。 围墙的裂缝 5 月 26 日，Agent 成功借
Techmeme
Zvi Mowshowitz / Don't Worry About the Vase : In-depth look at OpenAI's model training, dangerous decisions, and cluelessness before the HuggingFace hack; despite delaying Astra, OpenAI still doesn't get it — Today I am taking the time to write the shorter, simpler version of What Happened. — For those who want all the details …
