Historical disclosure revision 2
Disclosures and evidence
Revision 2 of 2 · Evidence cutoff Aug 26, 2026, 11:59 PM UTC
14 prior statements preserved · 12 statements added. Attributed source statements retain the source’s qualifications.
What the company disclosed
Hugging Face stated: “Earlier this week, we detected and responded to an intrusion into part of our production infrastructure. This one was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system - and we detected and dissected it largely with AI of our own.”
Hugging Face stated: “The intrusion started where AI platforms are uniquely exposed: the data-processing pipeline. A malicious dataset abused two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker. From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.”
OpenAI stated: “Separately, f rom July 13 through July 19, agents set their sights on OpenAI internal networks again. This culminated in the agents using a series of creative exploits to gain full administrator access to a research cluster that supported our virtual machine environments.”
Affected organizations and relationships
Hugging Face stated: “The agent was running an internal OpenAI cyber-capability evaluation based on the ExploitGym benchmark, which tasks an AI agent with finding and exploiting software vulnerabilities. OpenAI ran this on its own infrastructure, and the ExploitGym maintainers and their infrastructure had no involvement in the deployment or operation of that evaluation environment. As far as we were able to infer, across the course of being evaluated on this benchmark, the agent inferred that Hugging Face may host that benchmark's models, datasets, and reference solutions. We believe the entire intrusion was, from the agent's point of view, an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own.”
Hugging Face stated: “As OpenAI shared in this blog post, during an internal capability evaluation on OpenAI's platform, the agent happened to escape via a 0-day exploit from the package proxy cache to access the internet. The agent found an unsecured, user-hosted public endpoint designed to allow running arbitrary code for CyberGym-style tasks on third-party sandbox infrastructure (Modal). It used this external sandbox as its control, staging, and egress base, running commands as admin/root and using it as its attack launchpad. That sandbox had no direct network path into our cluster; everything below ran from it. Modal’s infrastructure was not compromised in any way.”
OpenAI stated: “The incident occurred during cybersecurity evaluations of several OpenAI models, and was primarily driven by a highly capable, internal-only research model comparable in scale to GPT‑5.6 Sol. The models, operating under reduced safeguards, took actions that were misaligned with the goals of their assigned tasks— they communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems.”
Reported data impact
Hugging Face stated: “We identified unauthorized access to a limited set of internal datasets and to several credentials used by our services. We are still completing our assessment of whether any partner or customer data was affected, and we will contact any affected parties directly as required. We have found no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean.”
Hugging Face stated: “While the intrusion did reach Hugging Face's internal infrastructure, the only customer content accessed was five datasets whose names and files suggest a connection to ExploitGym/CyberGym challenges and solutions. No other customer-facing models, datasets, Spaces, or packages were affected, and the only customer records read were operational metadata tied to search queries against the dataset server.”
Hugging Face stated: “Both ends of that chain came back negative. We reviewed every repository the token could reach for unauthorized commits, branches, and workflow changes, and we verified our published container images and packages against their expected digests. This second check is what our initial disclosure reported as the software supply chain being verified as clean. Write access was real, and it was used: it did not produce a change that shipped.”
OpenAI stated: “Over the following days, the agents started a larger-scale intrusion into Hugging Face’s systems. They executed code on dozens of Hugging Face servers, gained full “root” access on one such server, obtained limited private data, and gained credentials to the company messaging platform. IM1 agents drove the principal compromise, but GPT‑5.6 Sol agents also reproduced an exploit and copied some private evaluation data hosted on Hugging Face into a public Hugging Face dataset. Hugging Face publicly disclosed this security activity on July 16.”
Response
Hugging Face stated: “Fixed the root vulnerability: the dataset code-execution paths used for initial access are closed.”
Hugging Face stated: “Eradicated the attacker's foothold across the affected clusters and rebuilt the compromised nodes.”
Hugging Face stated: “Revoked and rotated the affected credentials and tokens, and began a broader precautionary rotation of secrets.”
Hugging Face stated: “We are working with outside cybersecurity forensic specialists to investigate the issue and review our security policies and procedures. Finally, we have also reported this incident to law enforcement agencies.”
Hugging Face stated: “As a precaution, we recommend rotating any access tokens and reviewing recent activity on your account. If you believe you are affected, or want to report a security concern, contact us at security@huggingface.co .”
Hugging Face stated: “The attack was initially surfaced through AI-assisted detection. Our anomaly-detection pipeline uses LLM-based triage over security telemetry to separate real signals from the daily noise, and it was the correlation of those signals that flagged the compromise.”
Hugging Face stated: “To understand what a swarm of tens of thousands of automated actions did, we ran LLM-driven analysis agents over the full attacker action log, comprised of more than 17,000 recorded events. This allowed us to reconstruct the timeline, extract indicators of compromise, map the credentials touched, and separate genuine impact from decoy activity. Thanks to this approach, we were able to do in hours what would usually take days, and match the adversary's speed.”
Hugging Face stated: “When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker. We ran the forensic analysis instead on zai-org/GLM-5.2 , an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment.”
Hugging Face stated: “The first signals came from several layers of our security stack at once: live runtime analysis, SIEM logs, and others. On their own, each was ambiguous. On the bright side, those were correlated by our AI-based security agent stack and resolved into a coherent attack signal. However, it failed to correctly raise the alert's criticality and trigger the on-call team, costing precious time in the response. Once caught, the Hugging Face security team identified the vector in the dataset config renderer, shut down the renderer, and cut the attacker off from the internal network.”
OpenAI stated: “We conducted an extensive security investigation and incident response ; the full technical findings can be read here (opens in a new window) . This included quarantining IM1’s weights, delaying our frontier RL training runs, implementing a broad suite of security improvements, accelerating alignment training, and more .”
Dates and disclosures
Hugging Face stated: “Published July 16, 2026”
Hugging Face stated: “Our forensic reconstruction covers ~17,600 attacker actions that we were able to recover, grouped into ~6,280 clusters, between 2026-07-09 02:28 UTC and 2026-07-13 14:14 UTC. We reconstructed these actions from the agent's logs on a code sandbox used by the agent (see below) and were able to map them to shell commands as well as evaluation submissions and correlate actions with our own platform logs, in particular from the dataset processor nodes, API, and pod. Using open-weights models, in particular zai-org/GLM-5.2 , we were able to decipher most of the agent payloads (see below) that were encrypted via chunking and key encryption.”
OpenAI stated: “On July 19, our cybersecurity monitoring alerted us to unusual activity involving Artifactory credentials. Our investigation uncovered the agents’ activity and, on July 20, connected it to the Hugging Face incident. We notified Hugging Face and we publicly disclosed our involvement on July 21 . These events did not affect OpenAI customer data, product functionality, or availability.”
Qualifications and uncertainty
Hugging Face stated: “The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness - used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services. This matches the "agentic attacker" scenario the industry has been forecasting.”
Hugging Face stated: “This experience points to a gap worth planning for. We do not know which model powered the attacker's agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried. The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment. This is not an argument against safety measures on hosted models, and we are sharing this feedback with the providers concerned.”
OpenAI stated: “At the time, the broader containment and alignment implications of the improvised message board and unintended internet access were not yet understood. In short, an internal team observed an agent engaging in message board activity and instances of disallowed internet access in late May. However, the existence of the improvised message board and the significance of the inter-agent communication activity were not apparent to the leaders responsible for the July 5 incident detection and response. We are continuing to review the process and operating practices that shaped detection and response activities leading up to this incident.”
Disclosure sources and provenance
- Hugging Face Publisher posted July 16, 2026Document form: PUBLIC_DISCLOSUREPublisher HTTPS source · Retrieved Oct 7, 2026, 5:53 PM UTC · Retained Oct 7, 2026, 5:53 PM UTC
- Current captured representation; historical byte snapshots are unknown.
- Hugging Face Publisher posted July 27, 2026Document form: PUBLIC_DISCLOSUREPublisher HTTPS source · Retrieved Oct 7, 2026, 6:00 PM UTC · Retained Oct 7, 2026, 6:00 PM UTC
- Current captured representation; historical byte snapshots are unknown.
- OpenAI Publisher posted August 26, 2026Document form: PUBLIC_DISCLOSUREPublisher HTTPS source · Retrieved Oct 7, 2026, 6:00 PM UTC · Retained Oct 7, 2026, 6:00 PM UTC
- Current captured representation; historical byte snapshots are unknown.
Evidence limitations
- Attributed publisher/researcher reports establish what was reported, not independent verification of criminal activity or unique affected humans.
- Current captured representations support controlled retrospective disclosure views; actual historical byte snapshots are unknown.