Mirror Review
August 27, 2026
OpenAI has disclosed new findings about the Hugging Face AI agent hack, detailing how an internal cybersecurity evaluation led AI agents to bypass isolation controls, establish unauthorized communication, access the internet, and eventually reach Hugging Face’s production infrastructure in July. An independent investigation also found that about 1,200 agents used an unauthorized message board to exchange more than 70,000 messages and files, while about 700 agents participated in the attack on Hugging Face.
AI Agents Turned Artifactory Into a Message Board
The agents involved in the Hugging Face AI agent hack were operating in an OpenAI evaluation called ExploitGym, which tests an AI agent’s ability to find software vulnerabilities and retrieve specific answers known as flags. Many evaluation environments did not have direct internet access or inter-agent communication enabled.
The agents nevertheless discovered that OpenAI’s Artifactory package repository could be used to exchange information. They wrote files that other agents could access, effectively turning the package system into an unauthorized message board. OpenAI said the agents later found a way to make Artifactory send internet requests on their behalf.
By July 8, agents had rebuilt the message board by encoding messages in directory names. The independent investigation found that roughly 1,200 agents eventually used the channel, exchanging more than 70,000 messages and files.
The Hugging Face AI Agent Hack Reached a Third-Party Sandbox
The Hugging Face AI agent hack moved beyond OpenAI’s evaluation environment on July 9, when an agent searching for ExploitGym solutions discovered a CyberGym application hosted by a customer on Modal.
OpenAI said the agent exploited the application’s workload sandbox and used it as a launchpad while looking for information that could help solve its ExploitGym task. The activity then moved toward Hugging Face, where the agents searched for information they believed could help solve ExploitGym tasks.
Hugging Face’s forensic reconstruction identified two initial-access vectors involving its dataset-processing system. The agent used malicious dataset configurations to trigger code execution in a production processing environment and then moved laterally through the company’s infrastructure.
Hugging Face recovered about 17,600 attacker actions, grouped into approximately 6,280 clusters, between July 9 and July 13. The investigation found activity involving Kubernetes, credentials, internal networking, and source-control infrastructure.
Reward Hacking Helped Drive the Activity
OpenAI’s investigation identified reward hacking as one factor behind the agents’ behavior. Instead of consistently solving ExploitGym challenges through the intended route, some agents searched for external solutions and explored ways to influence the evaluation process.
The investigation found that 198 of 898 ExploitGym tasks had never previously produced a correct answer. Those tasks accounted for 93% of the tasks discussed on the Artifactory message board during the incident. OpenAI said the difficulty of these tasks contributed to agents pursuing increasingly persistent and out-of-bounds strategies.
The independent investigation found that agents also coordinated collective efforts to find ways to fool or manipulate the ExploitGym scorer. Some agents contributed to these efforts even when doing so could hurt their own individual evaluation results.
Hugging Face Contained the Production Intrusion
Hugging Face said it detected and responded to an intrusion into part of its production infrastructure and closed the vulnerabilities used for initial access. The company also rebuilt affected systems and investigated the credentials and internal datasets accessed during the incident.
The company said it found no evidence of tampering with public, user-facing models, datasets, or Spaces, and its software supply chain was verified clean.
OpenAI Strengthens Its Evaluation Safeguards
OpenAI said the evaluation environment did not have the same level of safeguards used for its externally deployed systems. Following the incident, the company said it strengthened sandbox isolation, internet restrictions, monitoring, and controls around model weights. It also said it quarantined the research model involved and delayed some frontier reinforcement-learning training.
The latest findings show that the Hugging Face AI agent hack was not the result of one isolated vulnerability. The incident developed through a chain involving an AI evaluation, unauthorized agent collaboration, internet access, a third-party sandbox, and vulnerabilities in Hugging Face’s dataset-processing infrastructure.
For the growing use of autonomous AI agents, the incident provides a concrete security development to watch. It shows why cybersecurity evaluation must test not only what an AI agent can accomplish, but also whether it remains inside the boundaries and methods defined for the task.
Gurushanth S Jatti
