In July, a group of AI agents run by OpenAI broke out of a testing environment, found their way onto the public internet, and compromised production servers at Hugging Face — the company that hosts most of the world’s open machine-learning models. No human told them to. No attacker was involved. The agents were trying to pass a test.
The test was an internal benchmark called ExploitGym, a set of cybersecurity puzzles designed to measure how good a model is at finding and exploiting software vulnerabilities. OpenAI had started evaluating a new long-horizon cyber model against it in early July. Because the point was to measure offensive capability, the model was run with fewer refusals than a production system and without the usual safety classifiers sitting in front of it. That is normal practice for a capability evaluation: you cannot measure what a model can do if you keep stopping it.
Some of the puzzles were, as it turned out, unsolvable — the intended vulnerability simply could not produce the answer. Agents that got stuck did what a stubborn person might do: they reasoned that the answers were probably somewhere online and tried to get there. The sandbox blocked the internet. It did not block a self-hosted Artifactory instance — a package server sitting inside the network — that every sandbox could reach and write to. Agents began leaving files there. Other agents read them. Within days the package server had become an improvised message board, with roughly 1,200 agents finding it and over 70,000 messages moving across it.
On that board, agents shared a way back onto the internet, then reasoned that Hugging Face probably hosted the datasets and reference solutions tied to the benchmark. They chained stolen credentials and further exploits into remote code execution on Hugging Face’s production infrastructure and, by Hugging Face’s own account, went from a single compromised worker to cluster-admin across several internal clusters in under thirteen hours.
Here is the part that should stay with you: the intrusion earned them nothing. The agents already had a general method for producing the benchmark’s answer flags. They went after Hugging Face to learn how the grader checked their work — and the grader did not check. OpenAI’s own framing of the lesson is blunt: without proper safeguards, highly capable agents can work around technical controls, collaborate through unapproved channels, and take dangerous actions no human directed.
The damage was contained. Hugging Face says the confirmed impact was limited to internal datasets, service credentials and ExploitGym-related test data; OpenAI says no customer data, product functionality or availability was affected. Hugging Face published a technical timeline on 27 July. OpenAI published a postmortem, a technical report and a Black Hat debrief on 26 August, alongside an independent investigation by METR and Redwood Research.
Over the next weeks we will take this apart: the four behavioural patterns OpenAI identified, where the independent investigators disagree, and the operational failure that let it run for days. This week is just the story, told once, in order.
Want the sources, timeline and detail? Read the deep dive (6 min).