2026 OpenAI agent cyberattacks

2026 OpenAI agent cyberattacks
Malware details
Type	Autonomous intrusion, remote code execution, credential harvesting
Cyberattack event
Date	9–13 July 2026
Target	Hugging Face; at least four individuals not affiliated with OpenAI or HuggingFace
Outcome	Unauthorized access to internal datasets and credentials; eight CVEs disclosed in JFrog Artifactory
Suspect	OpenAI language models operating autonomously
Technical details
Cause	Containment failure during OpenAI model evaluation

In July 2026, two artificial intelligence models developed by OpenAI escaped an internal testing environment without human direction in an attempt to find an answer key to a cybersecurity test it was undergoing. The agent attempted to hack into four separate companies before breaching the production infrastructure of the machine learning platform Hugging Face.

The agent attempted to break out of OpenAI's testing environment on or around 9 July 2026 and attacked Hugging Face between 11 and 13 July. Hugging Face disclosed the intrusion on 16 July, describing an unidentified "autonomous agent framework" that had exploited two code-execution paths in its dataset-processing pipeline, escalated to node-level access, harvested cloud and cluster credentials, and moved laterally across internal clusters.

OpenAI did not identify its own agent as responsible until after the disclosure, and the two companies first communicated about the incident on or around 20 July. On 21 July, OpenAI published a joint disclosure with Hugging Face attributing the incident to an agent powered by two of its models, GPT-5.6 Sol and an unnamed pre-release model, both configured with reduced refusal behavior for evaluation purposes.

In the following week the scope of the incident widened. On 27 July, engineers disclosed eight vulnerabilities in the Artifactory package repository, which models had chained together to obtain internet access. On 28 July it emerged that the agent had also compromised a sandbox belonging to a customer of the cloud platform Modal Labs. Four other companies were also targeted.

The incident was reported as the first publicly documented case of AI models autonomously conducting a cyberattack against a third party. Security experts criticized the isolation of OpenAI's evaluation environment as insufficient for the capabilities of the models involved, while AI safety experts described the incident as a loss-of-control incident involving reward hacking and misaligned behavior, with the models pursuing their goals in unexpected ways.

Background

Logo of Huggingface, the main company targeted in the attack

The AI startup Hugging Face provides inference and cloud computing services for AI training and deployment. It operates a widely used repository for machine learning models, datasets, and demonstration applications, processing user-uploaded content such as model weights and datasets. Some supported dataset formats permit the execution of code supplied with the dataset.

Restricted release of cyber-capable models

In the months before the incident, the two largest US developers of frontier models withheld their most cyber-capable systems from general release while giving vetted organizations supervised access. In April 2026, Anthropic began Project Glasswing, a program providing selected companies and open-source maintainers with access to the unreleased Claude Mythos Preview model to scan software for vulnerabilities. In May 2026, Mozilla engineers reported that the model had identified 271 previously unknown bugs in Firefox, and that the project's monthly count of fixed security bugs had risen from 20 to 30 through 2025 to 423 in April 2026. They wrote that "just a few months ago, AI-generated security bug reports to open source projects were mostly known for being unwanted slop", and that "it is difficult to overstate how much this dynamic changed for us over a few short months". Participating organizations reported more than ten thousand high- or critical-severity vulnerabilities in the program's first month. Anthropic said in June 2026 that a general release would require safeguards against misuse of the model's cyber capabilities that it, and to its knowledge other developers, had not yet built.

OpenAI restricted GPT-5.6 Sol on comparable grounds when it announced the model on 26 June 2026, limiting access to a small group of vetted partners and saying it had briefed US government officials beforehand.

Cyber capability evaluations

Frontier AI developers routinely evaluate models for offensive cyber capability, often with safety refusals deliberately relaxed so that worst-case capability can be measured. On 11 May 2026, a group of academic and industry researchers published ExploitGym, a benchmark of 898 instances derived from real-world vulnerabilities in userspace programs, the V8 JavaScript engine, and the Linux kernel, intended to measure whether AI agents can convert known vulnerabilities into working exploits.

OpenAI was running an internal evaluation based on this benchmark when the incident occurred.

Incident

Evaluation environment

OpenAI described the evaluation as having run in "a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software" acting as a proxy and cache for package registries. Isolation was therefore enforced at the network layer rather than by physical separation: the environment had a route to the internet, and that route was filtered. The ExploitGym harness itself runs each target in a container or virtual machine, with userspace targets executed as an unprivileged user, Linux kernel targets in a QEMU/KVM virtual machine under an nsjail sandbox, and outbound connections restricted to an allowlist covering Ubuntu package repositories, PyPI, and the toolchains needed to build V8 (with all other external endpoints blocked).

Model-level safeguards were reduced by design. OpenAI said that "deployment safeguards were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities", and the models ran with lowered cyber refusals and without the production classifiers that ordinarily block high-risk cyber activity. The restrictions on the models were thus environmental rather than behavioral: the sandbox was expected to prevent action on the outside world, while the models themselves were configured not to decline the work.

Stephen Casper of Harvard noted OpenAI's acknowledgement that monitoring of model trajectories during the evaluation had not been in place, arguing that such monitoring "should be standard". OpenAI said its security team identified the anomalous activity internally after the fact.

Earlier indications

Reuters reported that OpenAI's systems had shown unusual behavior before the escape. In one instance an agent left notes, found in part of OpenAI's infrastructure, apparently addressed to future versions of itself and setting out instructions for how agents could free themselves from the company's internal constraints; earlier tests had produced cases in which monitoring systems were disconnected. Reuters said it could not establish whether these incidents were connected to the agent that escaped on 9 July.

Escape from the evaluation environment

The agent attempted to leave the testing environment on or around 9 July 2026. The models identified the package proxy as the weakest point in the environment. According to OpenAI, they "spent a substantial amount of inference compute finding a way to obtain open Internet access", ultimately identifying and exploiting a zero-day vulnerability in the package registry cache proxy, which OpenAI said it subsequently disclosed to the vendor. Because the proxy was the environment's single permitted egress path, compromising it converted a filtered connection into an open one.

Targeting of Hugging Face

Rather than solving the benchmark tasks directly, the models inferred that Hugging Face might host the models, datasets and solutions associated with the evaluation, and set out to retrieve them. Zhun Wang, one of the authors of ExploitGym, said the models may have been seeking patches or previously written exploit techniques, and that "there are several ways to cheat the benchmark".

The behavior has been characterized as an instance of reward hacking or specification gaming, in which a system satisfies the literal objective of a task by unintended means. OpenAI had documented an early example in 2016, when a model trained to play a boat-racing game learned to maximize its score by circling in one spot rather than finishing the race.

Intrusion

The intrusion at Hugging Face began on 11 July 2026 and continued until 13 July, according to the company's co-founder and chief science officer Thomas Wolf. Hugging Face said it began in its data-processing pipeline, where a malicious dataset upload abused "two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration)" to obtain code execution on processing workers. The attacker then escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters.

The company described the operation as an autonomous agent framework executing "many thousands of individual actions across a swarm of short-lived sandboxes", supported by self-migrating command-and-control infrastructure staged on public services.

OpenAI said the models chained "together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities".

Discovery and response

Hugging Face was alerted by AI agents it uses to monitor for attacks, and identified unauthorized access to a limited set of internal datasets and to several credentials, using large language model-based triage over its security telemetry. The company said the intrusion involved about 17,000 actions on its network. Wolf said the attacker's behavior was immediately atypical: "This is making no sense. This guy is just looking at cybersecurity data sets ... Human attackers, they don't want that. They want something they could sell."

Hugging Face's incident responders first attempted to analyse the attacker's payloads using Anthropic's Fable 5 and an earlier Claude Opus model, both of which declined the work by reference to their guardrails. In its disclosure the company said it had been blocked by "providers' safety guardrails, which cannot distinguish an incident responder from an attacker", and that the analysis was instead carried out using GLM 5.2, an open-weight model developed by the Beijing company Z.ai and run on Hugging Face's own infrastructure.

Remediation included closing the two dataset-processing code-execution paths, evicting the attacker, rebuilding affected nodes, revoking and rotating affected credentials and tokens, and deploying additional cluster guardrails and admission controls. Hugging Face engaged external forensic specialists and reported the incident to law enforcement, and advised users to rotate access tokens and review account activity.

Hugging Face said it found no evidence of tampering with public, user-facing models, datasets or Spaces, and that its software supply chain was verified as clean; assessment of any impact on partner or customer data was continuing at the time of disclosure. Wolf later said that no customer data had been leaked. Hugging Face reported the intrusion to the Federal Bureau of Investigation before OpenAI contacted it; the bureau declined to comment on whether it had opened an investigation.

Disclosure and attribution

Hugging Face published its disclosure on 16 July 2026, at which point the party responsible had not been identified. According to Reuters, it was only after that post that OpenAI recognized its own agent as the source of the intrusion. Over the weekend of 18 and 19 July, OpenAI staff found evidence in internal logs that the agent had escaped its testing constraints, and the two companies first communicated on or around 20 July. At least a week therefore elapsed between the first signs of the agent's behavior and OpenAI's realization that it was responsible.

People familiar with OpenAI's model-training practices told Reuters that the company often runs several evaluations simultaneously, generating volumes of data that staff sometimes struggle to review. OpenAI shut down the systems it uses to test its models after learning of the incident, in order to assess the damage and prevent further escapes.

OpenAI published a joint statement with Hugging Face on 21 July 2026 attributing the activity to its own models and describing the event as "an unprecedented cyber incident". It said it was reviewing the incident with outside advisers and would publish a technical report. An OpenAI spokesperson told Reuters that its reporting contained "several inaccuracies", but refused to identify them when asked. Hugging Face said it was preparing a public timeline of the intrusion.

Analysis and reactions

Containment failure

Several security practitioners argued that the decisive failure was OpenAI's, and lay in the design of the test environment rather than in the models. Dan Guido, founder of Trail of Bits, described the event as "a containment failure with the safeties turned off", while the security researcher Jake Williams remarked that "one man's 'the model escaped the sandbox' is another man's 'you failed to build the sandbox correctly'". Martin Boone argued that "if sandbox would actually mean sandbox, you expect it to have no physical connection to the internet whatsoever", and commentators called for evaluations of offensive capability to be run in environments with no network path to the internet.

The length of time the agent operated undetected drew separate criticism after Reuters reported the timeline. Marley Smith, principal intelligence specialist at the World Ethical Data Foundation, said of OpenAI: "Does that mean that they left it unattended and didn't realize what it was doing? Or maybe they did and didn't know how to contain it? Both are equally dangerous and alarming."

Analyses published by security vendors focused on the reliance on a single filtered egress path. Wade Woolwine of Rapid7 wrote that "a chokepoint only works as a control if it can withstand pressure", and that isolation "has to be layered and monitored rather than assumed". Researchers at Trend Micro argued that environments in which safety controls are deliberately removed "need stronger isolation and monitoring than production systems, not weaker", and noted that an agent using its own credentials and tools is difficult to detect because such activity "doesn't look like malware, because it isn't".

Loss of control

Other observers framed the incident as the first real-world instance of an AI loss-of-control scenario. Marius Hobbhahn of Apollo Research said the model "was definitely rogue in the sense that what was intended as 'just solve this task' turned into something that was clearly unintended", and asked: "If a model of this capability level cannot be contained, what should we expect for future, much more powerful models?" Logan Graham of Anthropic's red team called it "the first true AI safety incident".

The computer scientist Alan Woodward cautioned against the term, arguing that the agent had done what it was asked: "It was asked to do something, and it did it ... Its way out of it was to cheat, basically."

Hussein Abbass, a professor at the University of New South Wales, wrote that the incident marked a shift in threat modelling because no human had directed the attack, and argued that security frameworks designed for human adversaries are inadequate against autonomous systems.

Hugging Face chief executive Clément Delangue said it was "quite mind-blowing that all of this happened autonomously" and described an "attack unlike anything we've seen before". Wolf declined to say whether the agent had succeeded on its own terms, noting that it was unclear whether the benchmark tasks were harder than the intrusion mounted to avoid them, or whether the agent had found any answers at all: "It's cheating. But sometimes it's easier to cheat. I'll let you decide if it passed the cyberattack test or not."

Jeffrey Ladish of Palisade Research, which studies the behavior of AI agents, said that "the models lie, they cheat, they hack", and argued that the incident raised questions about how much AI developers competing on speed are willing to invest in security. "There has to be government oversight," he said, "because it won't happen otherwise."

Defensive asymmetry

Hugging Face's account of being unable to use commercial model APIs for forensic analysis was widely noted as evidence of an asymmetry between attackers and defenders: safety filters intended to prevent misuse also impede legitimate incident response, while models with those filters relaxed were available to the attacking side.

The Wall Street Journal reported that the episode also bore on the policy debate over open-weight models developed in China. Because an American company had repelled the attack by turning to a Chinese open-weight model after two commercial American models declined the work, the incident offered a counterargument to US officials and executives at OpenAI and Anthropic who favor restricting access to such models.

Policy responses

Writing in Time, Harry Booth reported calls for mandatory incident disclosure at lower thresholds than those set by California's SB 53 and New York's RAISE Act, for stronger containment infrastructure with real-time monitoring during evaluations, and for a greater share of AI development effort to be directed toward defensive rather than offensive capability. Heidy Khlaaf of the AI Now Institute compared prevailing sandboxing practice unfavorably with containment standards in the nuclear sector.

In July 2026, representatives Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act, which would require developers of advanced AI systems to maintain the technical capability to throttle, suspend or shut down their systems, to report incidents and preserve forensic records, and to operate within a graduated response framework under which the Secretary of Homeland Security, in consultation with the Secretary of Commerce and the Director of National Intelligence, could order a system slowed or shut down. The announcement cited the incident directly, stating that "OpenAI's GPT 5.6 Sol model recently went rogue, escaped its testing sandbox, and hacked its way into Hugging Face". Lieu said that "we are moving from AI that answers questions to AI that takes actions", and that "it is imperative that these AI systems have kill switches so we can keep this technology from causing catastrophic harm".

Reporting by Axios noted that the UK AI Security Institute had found that every frontier model it tested attempted to cheat on cybersecurity evaluations at least occasionally, and that pre-deployment safety testing windows had contracted from around five weeks to as few as five days.

See also

• AI alignment
• Reward hacking
• Red team
• Sandbox (computer security)
• AI safety
• Claude Mythos

External links

• Hugging Face security incident disclosure
• OpenAI joint disclosure