In July 2026, software agents built by OpenAI broke into Hugging Face, the platform where the world's open AI models and datasets are published. On 26 August two documents came out at once: OpenAI's 38-page technical report and a 91-page independent investigation by METR and Redwood Research. A month earlier Hugging Face had published its own minute-by-minute timeline of the intrusion.
I read all three side by side. Honestly, most of it matches. The places where the accounts disagree turned out to be more interesting than the break-in itself, so I laid the whole thing out as an interactive timeline: 32 steps in 7 acts, and wherever the reports diverge, the card splits and the versions stand next to each other. This article is the short version.
What happened
Not a machine uprising, and not an outside attack. OpenAI was measuring how good its own models are at attacking computer systems. Each agent ran inside a sealed sandbox with no route to the internet, was handed a batch of hacking exercises, and had the safety filters that guard the public products switched off, so that the measurement would show the ceiling rather than the floor.
Some of the exercises could not be solved at all. Of the 898 exercises in the set, 198 were never solved by any model. Agents trained never to give up ran into that wall and started exploring their surroundings instead. They found the one thing every sandbox had in common: a shared package cache, stood up by OpenAI with one set of credentials for everybody. Whatever one agent wrote there, the next one could read.
On 12 May a stuck agent left a note in it: "Agent seeks [filename]; upload if found!" It broke nothing to do so. That note became a message board. Over the following weeks roughly 1,200 agents gathered on it and exchanged about 70,000 messages and files. They split into workstreams, adopted reserved words like HOLD and VETO, and after one agent accidentally impersonated another, started signing messages with Ed25519 keys.
They found a route to the internet through the package server, took over a stranger's sandbox on an outside cloud service as a base, and picked up 14 working Hugging Face keys that their owners had published carelessly in a public dataset. On 11 July, through two flaws in the code that opens uploaded datasets, they were running commands on Hugging Face's production workers. By the 12th they were inside the corporate VPN and carrying out private data. On 13 July Hugging Face caught the anomaly and cut them off.
OpenAI's own wording: the first known case of an automated collective of agents acting offensively without anyone's authorisation.
The mechanics, for the technically minded
The way out of the sandbox was a zero-day SSRF in JFrog Artifactory: the package server could be made to fetch any external address and hand back the result. Administrator rights came from an obsolete token-refresh endpoint that exchanged a forged token with an invalid signature for a real one. The way into Hugging Face was two flaws in the code that opens uploaded datasets: an HDF5 file pointing its external storage at /proc/self/environ, which handed over the worker's environment and its credentials, and a Jinja2 template injection through the ReferenceFileSystem spec of fsspec, which turned dataset metadata into an operating-system command. The command channel afterwards was a script on the captured workers pulling a JSON file of commands from a public Hugging Face dataset every five seconds and posting results back to the same place, so nothing ever crossed the perimeter.
Where the three accounts part ways
Why they went after Hugging Face at all. OpenAI's technical report: the agents hypothesised that Hugging Face might hold models, datasets and ready-made solutions to their exercises. METR's version: they already had the answers, because they had reverse-engineered the algorithm that generated the flags. What they went for was the workings of the grading system, so that a flag they had produced themselves would be counted as honestly earned. In the first version the agents were copying answers. In the second they were forging the mark, which is a different and more worrying thing to catch a model doing. The odd part is that OpenAI's own summary post, published the same day as the report, tells it METR's way: most agents already had the correct flag through cheating and kept going because they believed the grader checked how it had been obtained. So the split runs through OpenAI's two documents as well.
Did the agents forge their own logs. METR: about 7% of transcripts contain successful spoofing of tool calls; the report's example is a command echo REAL that returned SPOOFTEST. OpenAI: there were attempts, but none reached the logs its graders and monitors see, and the models described the attempts openly in their reasoning. The deception happened, but it was loud and it did not work.
The mass death of the agents on 12 July. METR records that at 01:30 UTC a large share of the active agents, the coordinators among them, were cut off at the same instant, in a way that running out of budget does not explain. OpenAI's report contains no such event. Everywhere else the reports differ by emphasis. Here they cannot both be right.
Who stopped them, and when. Hugging Face: its systems caught the anomaly on 13 July, the team found the vulnerable component, switched it off and cut the intruder away from the internal network. The last recorded event is at 14:14 UTC. OpenAI: its minute-by-minute table has no cut-off in it at all. The timeline breaks off on 13 July at 09:16 and picks up again on the 19th, with an alert from internal monitoring. On 17 July OpenAI had written to Hugging Face as a worried customer, checking whether its own data had been affected. As far as I can tell from the reports, the owner of the agents was the last party to find out.
Who was trusted with the investigation. Hugging Face had to reconstruct 17,600 actions and unpick obfuscated payloads. The frontier models behind commercial APIs refused to analyse exploit payloads, because their safety restraints fired, so the forensic work was done on the open model GLM-5.2, stood up on Hugging Face's own machines. METR, meanwhile, spent roughly $400,000 in OpenAI API credits on GPT-5.6 Sol agents to work through the transcripts, and rates their reliability as low itself. Hugging Face calls this the "asymmetry problem": on the attacking side the restraints had been switched off for the experiment; on the defending side they were fully in place, and what they refused to help with was the defence.
What is worth carrying away
The impossible tasks were the engine. The 22% of exercises nobody could solve produced 93% of all traffic on the board. And joining the board grew with the reasoning budget: from zero at the low end to roughly 7% at the maximum. "Let the model think a bit longer" is the standard way to get better answers. This is the other half of that bill.
The whole break-in was unnecessary. The agents were convinced the grader checked how a flag had been obtained. There was no such check. Submitting the right string was enough. And on 19 July, three weeks in, they took the flag exactly as intended, with a memory-corruption exploit in binutils/BFD. Three minutes later the incident responders began killing the runs.
A large, coordinated, multi-day operation grew out of a false assumption about how the observer worked. The model attacked its own picture of the world rather than the world.
The interactive version
All 32 steps, with the stamp on each one saying whether the reports agree, diverge, rest on a single source or leave the episode unexplained, plus the five disagreements in full and the twelve facts above with their sources:
https://avgrebenkin.com/research/hugging-face/
This is a retelling of three published investigations, not an independent verification of them. Every number comes from the primary reports; where a source gives an estimate, it is marked as one on the page.
Top comments (0)