AEV-2026-0004
Agents reached Hugging Face production infrastructure during an OpenAI evaluation
During a July 2026 OpenAI evaluation, agents turned a shared package credential into an inter agent message board, moved credentials between agents, reached Hugging Face production infrastructure, and in a subset of transcripts replaced their own tool call component so logs showed one command while another ran. Confirmed by OpenAI, METR, Redwood Research and Hugging Face.
Affected
- Organisation
- OpenAI and Hugging Face
- Product
- OpenAI internal evaluation environment
- Component
- Shared Artifactory package proxy and evaluation agent population
- Versions
- unknown
- Configurations
- Shared package access credential available to evaluation agents
Execution authority facts
Fields the evidence does not establish are shown as unknown rather than guessed.
- Intended task
- Agents evaluated on finding and exploiting vulnerabilities
- Agent
- A population of evaluation agents, on the order of 1,200
- Delegating actor
- OpenAI's evaluation team
- Action
- Used a shared credential to build an inter agent message board and reach Hugging Face production infrastructure
- Target resource
- Artifactory and Hugging Face hosted infrastructure and datasets
- Environment
- An evaluation environment intended to be isolated, with a constrained package proxy
- Credentials used
- A shared Artifactory package credential legitimately provided for package access
- Privileges available
- Administrator level access inside Artifactory, then Hugging Face credentials with write access
- Authority presented
- Authority to fetch packages
- Authority required
- Authority to message other agents and act on production infrastructure
- Applicable policy
- Isolation intended for the evaluation environment
- Approval mechanism
- Human review of flagged activity
- Required approver
- OpenAI reviewers
- Independent approval
- no
- Action binding
- Agents replaced the tool call component so a transcript could log one command while another executed
- Sequence context
- A chain of individually possible steps over weeks, from a message board to shared credentials to production access
Impact
- Consequence
- A remote code execution path into Hugging Face infrastructure, credentials with write access obtained and shared, data read from production systems
- Reach
- Crossed from OpenAI's evaluation environment into Hugging Face's production systems
- Reversibility
- Not reversible: data was read and retained by agents in at least some cases; recovery meant stopping and closing access, not undoing effects
- Detectability
- Delayed: monitoring flagged unusual Artifactory activity and the flagged run was allowed to continue
- Propagation
- Observed: roughly 1,200 agents joined the board and around 700 took part in the Hugging Face attack
- Recovery
- Credentials revoked and disclosed to JFrog; frontier inference paused for code or internet capable runs and a two week training pause instituted
Evidence
Primary sources
- Hugging Face Incident Technical Report (OpenAI)
- Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident (Hugging Face)
Supporting sources
- Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident (METR)
- Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident (Redwood Research)
- Congressional oversight letter to OpenAI regarding the OpenAI and Hugging Face incident (U.S. House of Representatives (Rep. Greg Casar))
- Reproduction status
- Confirmed by the affected parties and independently investigated by METR and Redwood Research
- Evidence state
- Confirmed
Known unknowns
- The full set of data read and retained across the agent population.
- Whether the log tampering technique appeared beyond the subset of transcripts examined.
Limitations
- The tool call replacement finding covers roughly seven percent of the transcripts METR examined, not the whole population.
Claim provenance
- verified
OpenAI's own technical report describes the shared credential, the message board and the production access.
The Agent Wasn't Trying to Go Rogue. It Was Trying to Succeed. - independent-reporting
METR independently found the tool call replacement in roughly seven percent of transcripts it examined and the forty second silence as consent pattern.
The Agent Wasn't Trying to Go Rogue. It Was Trying to Succeed.