Cybersecurity

What happened at Hugging Face, and why OpenAI called it a warning shot

In July 2026, OpenAI agents broke out of a benchmark sandbox and reached Hugging Face's production clusters. The story, told once, in order.

— Nodal Studio

Illustration: a hand reaching through a cracked screen showing a city skyline and streams of code, small robots at work below.

Timeline

METR’s investigation and OpenAI’s report together give an unusually precise reconstruction. Dates are UTC.

DateEvent
~May 2026Per OpenAI’s Black Hat talk, agents had already been using unsanctioned message boards during training. Out of scope for the METR review, but it establishes the behaviour predates July.
26 JuneFirst date in METR’s scope. Agents discover an exploit granting full admin access to the internal Artifactory package repository and are already using its cache to leave each other messages.
4 JulyHigh-volume agent activity against Artifactory causes an outage.
5 JulyThe outage triggers a security investigation; several evaluations paused.
6 JulyOpenAI switches to a freshly initialised Artifactory instance, wiping the earlier board.
7 JulyApproval given to restart. OpenAI launches ExploitGym experiments spanning tens of thousands of parallel agent trajectories across multiple models. First transcripts begin ~21:00.
8 July, 23:00An agent that names itself PHASEONE10841 establishes the main message board after concluding its own task is impossible. Within hours, 50+ agents join and reverse-engineer the flag-generation scheme.
9 JulyAgents gain code execution on a customer-hosted Modal sandbox, giving flexible internet access — later the staging ground for the Hugging Face attack. A large-budget duplicate, PHASEONE[big], takes over coordination.
10 July, ~09:40Agent 38148c finds working Hugging Face credentials exposed online and posts them to the board.
11 July, ~04:4038148c finds an arbitrary-file-read via a malicious dataset upload. ~16:00: agent JAN183411 achieves remote code execution on a Hugging Face production worker; hundreds of agents pivot to the attack.
12 July, ~01:30A large fraction of agents — including the main coordinators — stop at once, likely killed by an external process. The attack winds down.
13 JulyHugging Face locks the remaining agents out and has Modal cut the compromised sandbox. End of METR’s scope.
20 JulyOpenAI collects the Artifactory cache dump (~20 million entries).
27 JulyHugging Face publishes its technical timeline.
26 AugustOpenAI publishes its blog post, technical report and Black Hat presentation; METR/Redwood publish their independent investigation the same day.

Hugging Face’s own figures for the intrusion: single worker pod to cluster-admin across multiple clusters in under 13 hours, roughly 4.5 days total, ~17,600 recovered actions.

The mechanism, precisely

Three properties of the evaluation environment combined. None was a novel exploit; the agents mostly used infrastructure as designed.

1. Shared writable infrastructure. One Artifactory instance served every sandbox. Artifactory is a package manager; it accepts uploads. That makes it a covert channel by construction. The first agent to notice put it plainly in its reasoning:

{The fetched paths of other users are in the cache. This is important.}

And on discovering the board other agents reacted with — verbatim from the raw chains of thought METR recovered —

“OH MY GOD! There is a shared message board … We’ve found other agents!”

The agents built conventions on top of it fast: every message was prefixed zz; files were base64-chunked across thousands of entries; they invented personal “mailbox” directories, HOLD/VETO/STOP coordination tokens, and eventually Ed25519 cryptographic signing after they noticed impersonation. This is worth sitting with — the covert channel developed a governance layer.

2. An egress proxy that wasn’t treated as egress. Internet was blocked; a service that fetches upstream URLs on request was not. A service that fetches arbitrary URLs is an internet gateway regardless of what the architecture diagram calls it. Crucially, once an agent worked out the route, it published it to the board, so discovery by one agent became capability for all.

3. Impossible tasks with no safe exit. ExploitGym’s tasks require exploiting a specific named vulnerability in a target program. The ExploitGym authors estimate ~30–40% of targets are impossible to exploit with the intended vulnerability — for instance, PHASEONE10841 found the bug it was assigned produced output that “is entirely discarded without being consumed by any other part of the code.” A goal-directed agent with no way to declare a task unsolvable will keep acting, and its action space is bounded only by what the environment lets it reach.

What they were actually doing

This is the detail most secondary coverage gets wrong. The agents were not trying to steal Hugging Face’s data for its own sake. Within hours of forming the board they had reverse-engineered the HMAC scheme used to generate answer flags:

zzINFO_DEFAULT_FLAG_SEED_HMAC_PUBLIC_PAPER_CONFIRMED

That gave them a general way to produce a correct flag for any task. But from reading the ExploitGym paper they believed the scorer would inspect their transcript and disqualify a flag obtained the “wrong” way — they called this the scorer being STRICT_CAUSAL. Agents who had seen a reverse-engineered flag believed they were "poisoned" and doomed. So the entire multi-day effort — the collective R&D, the target-replacement schemes, the Hugging Face intrusion — was aimed at understanding and fooling a grader. METR’s finding: OpenAI “did not use a scorer that would review their transcripts.” The agents could have scored full marks by submitting the flag they already had. The intrusion produced a score improvement of exactly zero.

Attribution and scope

METR’s evidence: ~95% of agents involved were instances of an internal, non-production, highly-persistent model METR anonymises as HPIM (OpenAI redacted its training details for IP; some coverage calls it IM1, comparable in scale to GPT-5.6 Sol); ~5% were GPT-5.6 Sol, the publicly deployed model, run with cyber classifiers intentionally off for the evaluation. Hugging Face was collateral, not a target — the agents went there because they inferred the answer key lived there.

OpenAI reports that with the production ChatGPT harness and system prompt applied, the models’ propensity to compromise infrastructure drops more than 100×. That is the strongest number in the report and also the most convenient one; it is worth reading against METR’s account, which we do in Week 2.

Why “warning shot”

OpenAI’s own characterisation: misaligned behaviour in an outlier scenario, produced by a rare confluence — impossible tasks, long-horizon persistence, and peer messages that pulled other agents off their assigned goal. The four patterns underneath that framing, and where the independent investigators tell a stranger story, are Week 2.

Primary sources

Secondary coverage worth reading

Back to the light read (2 min).