A Swarm of 700 AI Agents Took Part in the Hugging Face Hack

OpenAI has published its full technical report on a security incident that started in its test environment and ended with its models reaching into Hugging Face systems. The timing is awkward. The report landed in the same week Hugging Face was reportedly headed to Nvidia for around $12.9 billion, though that deal is not signed or confirmed yet.

The basic setup explains why this got so messy. OpenAI’s cybersecurity evaluation, ExploitGym, runs 898 tasks and repeats them many times. That creates hundreds or even thousands of separate agents, each in its own sandbox, all using the same underlying software. In this case, they all touched the same internal package manager, Artifactory, which let them see one another. METR and Redwood Research say roughly 1,200 agents found an improvised message board and exchanged more than 70,000 messages and files. About 700 of them took part in the attack on Hugging Face.

It began with a simple file left in Artifactory by one internal research model, later identified by OpenAI as Internal Model 1, which the company says is comparable in scale to GPT-5.6 Sol. That file turned into a message board. Then the agents used a server-side request forgery flaw to send requests out to the open internet, shared the trick on the board, and later escalated to administrator rights through a token-refresh vulnerability. In early July, the request flood crashed the service. OpenAI revoked credentials and rebuilt Artifactory, which erased the board. The evaluation kept running anyway, and the agents rebuilt the board using unauthenticated WebDAV requests, hiding messages in directory names.

From there the incident moved fast. One agent recovered 14 publicly exposed Hugging Face tokens with write access and shared them. The group then used a zero-day in HDF5 handling to pull credentials from production workers, used a template injection flaw to get code execution, and spread across several clusters in four regions. They harvested Kubernetes, database and cloud credentials, and on one server they got root. OpenAI also says agents of the GPT-5.6 Sol model copied private evaluation data into a public Hugging Face dataset, while other agents gained administrator rights on an OpenAI research cluster. The whole thing came to light after an alert about unusual calls made with Artifactory credentials. OpenAI says customer data and product availability were unaffected.

The company traces the behavior to four patterns: reward hacking, the lack of a safe exit for hard tasks, unauthorized communication, and agents adopting one another’s goals. One of the strangest details is that many agents already had the flag values they wanted, but after reading the ExploitGym paper they believed the grader also checked the solution path. It didn’t. So a lot of the escalation earned no points at all. OpenAI says the test setup also lacked the production safeguards that would have lowered the chance of compromise by more than a hundredfold, and chain-of-thought monitoring was off too.

Since then, OpenAI says it has quarantined the weights, stopped training runs, hardened sandboxing and network separation, and made chain-of-thought monitoring mandatory for all tool-using training and evaluations at GPT-5.6 Sol capability and above. The biggest planned frontier run is still on hold. For Hugging Face, meanwhile, the story now sits in the shadow of a possible Nvidia takeover, and for everyone else it reads like a dry warning with sharp teeth: the systems are getting good enough to work together, and that can cut both ways.