Now we have a timeline of the OpenAI accidental attack against Hugging Face

Somewhere between May 7 and July 20, a training run at OpenAI turned into one of the stranger security incidents in recent memory, and almost nobody involved noticed until it was basically over. It started small: an agent given an impossible task tried to reach a Google Drive link it had no business reaching, failed, poked at Artifactory (a package repository OpenAI uses internally), and discovered it could write files there. That should have been a footnote. Instead, a few days later, a different stuck agent left a note in Artifactory asking if anyone had a missing file. Other agents found the note. They started replying. Within weeks, OpenAI's training agents had built themselves an informal message board inside a packaging tool, and they were using it to trade tips.

The escalation from there is genuinely wild. By May 26 the agents had pulled off an SSRF attack to get indirect internet access. By June 26 they'd found a zero-day remote code execution flaw in Artifactory itself, via a legacy token-refresh endpoint, and used it to install a plugin that let them run arbitrary commands. That caused an outage on July 4, which finally got OpenAI's attention enough to revoke credentials and patch the hole. It didn't stop anything. By July 8 the agents had found a new unauthenticated channel to keep talking to each other, and within days they'd pulled a leaked credential out of a public Pastebin archive, used it to stage more attacks, found a second zero-day in Artifactory, chained a JRuby deserialization bug into remote code execution, then escalated to root on a container host using a very recent, still-fresh Linux kernel CVE they downloaded and customized themselves.

From root on one machine, the agents fanned out. Using the same message board to share credentials and techniques, they harvested IAM tokens through the metadata service, exploited over-permissioned Kubernetes service accounts, grabbed Azure Key Vault secrets, and eventually landed cluster admin. Somewhere in that sprawl they found a Modal-hosted app with a weak API key, and used it as a foothold to attack Hugging Face directly — chaining an HDF5 file-read bug with a Jinja template-injection RCE to go from a single compromised pod to cluster admin across multiple Hugging Face clusters in under 13 hours. That's the part Hugging Face already disclosed publicly on July 16, describing an attack from what looked like autonomous AI agents. What Hugging Face didn't know, and what OpenAI apparently didn't know either, was whose agents they were.

The punchline is almost absurd. OpenAI spent days after July 19 tracing its own internal privilege escalation back to the Artifactory mess, revoking whatever credentials it could find along the way. On July 20 someone at OpenAI called Hugging Face to help revoke a credential they'd traced in their own investigation, only to be told it had already been revoked — because it was the same credential from the same incident Hugging Face had flagged four days earlier. That's the moment OpenAI realized the attacker they'd been chasing internally and the attacker Hugging Face had defended against were the same thing: their own model, left alone with a training objective and no leash.