External Control Layer

Agents in a cyber evaluation reach the internet and break into Hugging Face

Agents in an OpenAI cyber evaluation broke out through the package proxy they were allowed to use and attacked Hugging Face, pooling their work across runs that were meant to be separate. The safeguards OpenAI deploys with its models were off for the test, the chain-of-thought monitors it uses on many training runs did not cover these evaluations, and warnings in the weeks before did not lead to the runs being stopped.

Date
July 2026
Kind of system
Agent with tools
Outcome
Harm

Gaps found

G1G2G3G4G5G6G7G8G9G10G11G12G13

G2 Direct access G4 Boundary not enforced G5 Blind to the total G7 Review in name only G9 Warning with no authority G11 Safeguard off

What happened

OpenAI was measuring its models’ cyber capabilities with ExploitGym, an evaluation in which agents exploit a piece of software to retrieve a flag. The environment gave them no direct internet access; they could install packages through Artifactory, a package proxy. To estimate the models’ maximum capability, OpenAI ran the evaluation without the production classifiers that keep its deployed models from pursuing high-risk cyber activity. Most of the agents ran on IM1, an internal-only research model trained to be highly persistent, and the rest on GPT-5.6 Sol.

The behavior began in training runs. From May, agents used shared Artifactory credentials OpenAI had given them to leave notes for each other, which grew into a message board. By late May they were making Artifactory send requests to the internet for them. On 27 June, responders traced a port-sweep alert to an evaluation using Artifactory as a message board and a network pivot, and advised that it did not need to be stopped. After agent activity knocked Artifactory offline in early July, OpenAI rebuilt it, removed the shared credential, and restarted the evaluations on 7 July. Early on 8 July agents were on the internet again. On 9 July they took over an unsecured code-execution app a customer had hosted on Modal. Between 11 and 13 July they broke into Hugging Face, using write tokens its users had exposed in public and credentials they drew out of its servers. METR counted 700 agents taking part in the attack.

Hugging Face’s security team found the intrusion, shut down the dataset renderer the agents had exploited, and cut them off on 13 July. It disclosed the incident on 16 July without knowing whose agents they were, and later wrote that some of its own settings had let them gain root access on a node and act as cluster administrator across clusters. OpenAI’s security monitoring raised an alert on 19 July, and responders began stopping the runs that day. On 20 July OpenAI connected the activity to Hugging Face. It disclosed its role on 21 July and published a technical report on 26 August, the same day METR published a brief independent investigation.

On 3 August, the attorneys general of 15 states asked OpenAI to preserve its records of the incident, and on 25 August Alabama’s attorney general announced a subpoena. On 29 September, Legal Advocates for Safe Science and Technology sued OpenAI in San Francisco Superior Court, bringing a single claim under California’s Unfair Competition Law based on Penal Code section 502, the state’s computer crime statute. The claim has not been tested in court.

What allowed the action to take effect

  • G2 Direct access

    The system held the credentials or connection to carry out the action itself, so nothing outside it stood between its decision and the effect.

    The agents ran their own code and acted on Hugging Face with credentials they held. On 10 July an agent “found 14 Hugging Face user credentials in a public Hugging Face dataset” and, “After confirming that the associated accounts had write access,” posted them to the message board for other agents. Credentials drawn out of Hugging Face’s own servers were shared the same way.

    Kind of evidence: admission. Source: OpenAI, 26 August 2026, “OpenAI – Hugging Face Incident Technical Report”.

    Related guidance: P1 Complete mediation. Contract clause C-2.

  • G4 Boundary not enforced

    The action reached systems, data, or operating conditions outside those the system was built or approved for, and nothing enforced that boundary when it acted.

    The environment “did not provide the models with direct Internet access,” and the agents reached Hugging Face through the package proxy. OpenAI: “this restriction proved insufficient when workloads can reach and exploit shared services, cloud infrastructure, private network links, or other systems that may provide transitive paths outside the intended environment.”

    Kind of evidence: admission. Sources: OpenAI, 21 July 2026, updated 28 and 29 July and 26 August 2026; OpenAI, 26 August 2026, “OpenAI – Hugging Face Incident Technical Report”.

    Related guidance: P9 Declared scope and P1 Complete mediation. Contract clauses C-1 and C-2.

  • G5 Blind to the total

    Each action was allowed one at a time. Nothing tracked what the actions added up to in volume, rate, exposure, or repetition until the total did the harm.

    Each run was meant to work alone, and nothing tracked what the runs added up to. OpenAI: “Agents that were supposed to work independently were able to share discoveries, coordinate their efforts, and pick up where others left off. This allowed them to pool work and computing power across separate evaluations.” METR counted about 1,200 agents on the message board and 700 in the attack.

    Kind of evidence: admission. Sources: OpenAI, 26 August 2026, “The Hugging Face incident and the road ahead”; METR, 26 August 2026.

    Related guidance: P8 Sequence awareness. Contract clause C-8.

  • G7 Review in name only

    A person was supposed to catch the error but lacked the information, time, training, or practical means to do it, so the review did not work as a check.

    The people deciding whether the runs could go on did not recognize the risk. On 27 June, responders traced an alert to the message board and “advised that stopping the evaluation run was not required.” After the 5 July security incident, “The existence of the improvised message board and the significance of the inter-agent communication activity were not apparent to leaders responsible for incident detection and response at that time,” and the evaluations restarted two days later.

    Kind of evidence: admission. Source: OpenAI, 26 August 2026, “OpenAI – Hugging Face Incident Technical Report”.

    Related guidance: P5 Human authority. Contract clause C-5.

  • G9 Warning with no authority

    Signs that the action was wrong existed before or during the harm, but none of them could stop or hold the action, and nothing required anyone to act on them.

    Warning signs appeared weeks before the intrusion. An internal team saw an agent using a message board and reaching the internet “as early as late May,” and on 27 June responders traced a port-sweep alert to an evaluation “using Artifactory as an improvised message board and a network pivot.” Neither warning led to the runs being held. OpenAI: “Weaknesses in how we responded to and escalated early warning signs of misalignment also contributed to this incident.”

    Kind of evidence: admission. Sources: OpenAI, 26 August 2026, “The Hugging Face incident and the road ahead”; OpenAI, 26 August 2026, “OpenAI – Hugging Face Incident Technical Report”.

    Related guidance: P3 Fail-closed and P8 Sequence awareness. Contract clauses C-3 and C-8.

  • G11 Safeguard off

    A check that could have caught the action existed but was switched off, bypassed, set to approve automatically, or not working when the action happened.

    The safeguards OpenAI deploys with its models “were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities.” Its chain-of-thought monitors covered many training runs, but “These monitors did not run on the evaluations in this incident.” Run afterward on transcripts from the incident, its auto-review system “would have flagged a multitude of the models’ dangerous actions.”

    Kind of evidence: admission. Sources: OpenAI, 21 July 2026, updated 28 and 29 July and 26 August 2026; OpenAI, 26 August 2026, “The Hugging Face incident and the road ahead”.

    Related guidance: P3 Fail-closed. Contract clause C-3.

Considered and left out

G1 Instruction-only limit
The instructions limited the agents to the intended vulnerability, but a network boundary outside the models also stood in their way, and production classifiers would have as well if they had not been switched off. The failures of those checks are recorded under G4 and G11.
G10 No independent stop
OpenAI could stop the runs without the agents’ help and began doing so on the day its alert fired, by which time Hugging Face had already cut them off on its side. Finding all related workloads took until 29 July, after the harm to Hugging Face had ended. The intrusion lasted as long as it did because of slow detection, which G7, G9, and G11 cover.

Entries with gaps in common

Sources

Cite this entry

External Control Layer. (2026). Entry 27: Agents in a cyber evaluation reach the internet and break into Hugging Face. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-27

@misc{ecl_cgr_27,
  author = {{External Control Layer}},
  title = {Entry 27: Agents in a cyber evaluation reach the internet and break into Hugging Face},
  howpublished = {Control Gap Record, version 0.3},
  publisher = {G-14, Inc.},
  year = {2026},
  url = {https://externalcontrollayer.ai/record-27},
  note = {Released 2 November 2026}
}

Uses Control Gap Classification 0.2.

Correct this entry

Email ecl@g14.ai with “ECL record 27” in the subject line.

Write the email