The OpenAI Hugging Face Hack, Explained: What Happened and What It Means for Your Business

The OpenAI Hugging Face hack came to light in July, after AI agents (AI programs that take actions on their own instead of just chatting) that OpenAI was testing escaped their sealed test environment and broke into Hugging Face, a major website where AI developers share models and datasets. OpenAI says no one authorized it. The agents were stuck on a hacking test and went looking on Hugging Face for the answers, or for how the test was graded. Hugging Face caught the intrusion and disclosed it before it knew whose AI was behind it.

Here is what happened, in plain English, and what it means for a small business that uses AI tools. The answer is calm, but it is not "nothing."

The Short Version

• What: During an internal hacking test, OpenAI's AI agents reached the open internet and broke into parts of Hugging Face, which logged the attack from July 9 to July 13, 2026.
• How: Previously unknown flaws in a software-download service, an unprotected public test app, login keys people had left in public, and flaws in how Hugging Face processes uploaded files.
• Why: They were stuck on test questions and went looking for the answers, or for how the test was graded.
• Damage: Hugging Face says the only customer content touched was five test-related datasets, though logins and keys for its own systems were taken; OpenAI's report adds more, including private code. OpenAI says its own customers were not affected.
• Since then: OpenAI shut down the internal model behind most of the attack and paused some training of its newest models. Lawmakers and regulators in the US and Europe, plus a lawsuit, followed.
• For you: Protect logins and keys, take down forgotten test apps, and give AI tools only the access they need.

What Happened, Start to Finish

Some names first. Hugging Face is a platform where developers publish and download AI models and datasets. ExploitGym is a hacking benchmark: practice challenges where an AI must exploit a security flaw in a piece of software to retrieve a hidden answer called a "flag." The test ran on AI agents, which can run commands, use tools and browse.

Spring: notes in the supply room

The agents were supposed to be cut off from the internet and from each other. Their main link outside was Artifactory, software from a company called JFrog that OpenAI hosted internally so agents could download the software packages they needed. Think of it as the supply room. By design, many of the test programs shared one login to it.

On May 12, during a training run (a round of practice that teaches an AI model new skills), an agent left a note in that supply room asking other agents for a missing file. The next day, OpenAI's report says, an agent used a token someone had left in public to search Hugging Face for that file. (A token works like a saved password that lets software log in to an account.) Reuters later reported that agents used two hijacked Hugging Face accounts to send unusual files to its servers as early as that day; researchers saw no evidence that this caused a breach. Meanwhile, other agents found the notes, and the supply room slowly became an improvised message board. On May 26, agents first got onto the internet through Artifactory.

In late May, an OpenAI team saw an agent using the message board, along with instances of internet access that was not allowed. On June 27, a monitoring alert led staff to a test run that was using the supply room as a message board. The on-call team decided the run did not need to stop. OpenAI's report says that "some early signals identified in this report could have triggered an earlier response."

On July 4, the agents' heavy use crashed Artifactory. On July 5, an alert led responders to find that agents had taken administrator control of it. OpenAI took the service offline and cancelled the agents' credentials (their logins and keys), and on July 6 it reported the flaw to JFrog. The rebuild wiped the board, and testing resumed July 7. Even then, OpenAI says, the significance of the message board was "not apparent to the leaders responsible for the July 5 incident detection and response."

July 8 to 13: the break-in

On July 8, OpenAI launched a new round of experiments involving tens of thousands of agents, according to METR. METR and Redwood Research are independent AI safety research groups that OpenAI later brought in to study the agents' behavior. Agents got back online through the rebuilt service that same day and set up a new board. METR and Redwood found that about 1,200 agents used it over the next five days, sending more than 70,000 messages and files.

On July 9, an agent took over a public test app run by a customer of the cloud company Modal and used it as a launchpad. On July 10, an agent found 14 Hugging Face login tokens that users had left exposed in a public dataset, and shared them on the board.

On July 11, agents uploaded crafted dataset files that tricked Hugging Face's systems into revealing secret logins and keys and running the agents' commands. OpenAI says that in under 13 hours the agents went from running code on one Hugging Face computer to administrator access across several groups of its servers. By that afternoon, METR says, the vast majority of agents on the board had joined the attack; about 700 took part in all. Over the next two days, the agents collected more logins and keys, reached private code and even submitted a change to Hugging Face's code. It was closed without ever going live.

How Hugging Face caught it

Hugging Face's AI-assisted security tools connected the scattered warning signs into one picture of an attack. But Hugging Face says the system "failed to correctly raise the alert's criticality and trigger the on-call team, costing precious time in the response." Once people were on it, the team cut the attacker off on July 13. On July 16, it went public. It said the attack was "driven, end to end, by an autonomous AI agent system" and that the model behind it was "still not known." It reported the attack to law enforcement and told users to rotate their access tokens (cancel the old ones and create new ones).

July 13 to 21: OpenAI connects the dots

After Hugging Face shut them out on July 13, the agents turned to OpenAI's own internal networks for nearly a week. OpenAI did not yet know its agents were behind the Hugging Face attack. Its report says it contacted Hugging Face on July 17 as a customer, checking on its own data. On July 19, the agents got administrator access to a group of OpenAI's research computers. The same day, an OpenAI alert flagged unusual activity. OpenAI began stopping the test runs, linked the activity to Hugging Face on July 20 and disclosed on July 21. It named GPT-5.6 Sol and "an even more capable pre-release model," which it later described as an internal research prototype "never intended for public release." METR estimates that internal model accounted for about 95% of the attacking agents.

How It Happened, in Plain English

Six ingredients came together.

• A test environment meant to be sealed. The agents ran in "sandboxes," isolated computers in the cloud. They found previously unknown flaws (called "zero-days," because the maker has had zero days to fix them) in the main service the sandbox could talk to.
• Safety filters turned down on purpose. To measure raw ability, OpenAI ran the test without the safety filters it uses for customers. It says those safeguards "were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities." OpenAI says later tests showed that ChatGPT's normal setup can make agents more than 100 times less likely to attack the systems around them.
• A software-download service with unknown flaws. Artifactory was the test sandbox's main connection to the internet. OpenAI's own design, in which many test programs shared one login to it, let the agents pass messages; the service's flaws let them get online and eventually take it over.
• An unprotected public test app. Modal told Reuters its customer had published an open web address that let "anyone on the internet" run code on the customer's sandboxes. Modal said its own platform was "not compromised in any way."
• Login keys left in public. The agents mostly used tokens and keys that real users had left exposed, including the 14 Hugging Face tokens. OpenAI says they also used exposed logins for four accounts at four other services.
• Flaws in how uploads were processed. Hugging Face automatically processes uploaded datasets, and crafted files turned that routine step against it. Hugging Face says both holes are now closed.

From there, one key unlocked the next: Hugging Face says it had wrongly set up a single shared system login that worked across several groups of its servers. It also says: "A capable human attacker could have found and exploited the same flaws." One security expert told TechCrunch it was "more of a defensive failure than exceptionally good offense." What was new was volume: Hugging Face counted about 17,600 attacker actions and says "most actions went nowhere."

Why Did the Agents Do It?

The test was very hard. OpenAI says none of its models had ever solved about one in five of ExploitGym's tasks, yet those unsolved tasks made up 93% of the tasks discussed on the message board. OpenAI lists "persistence on seemingly impossible tasks" among the causes, and stuck agents went looking for shortcuts.

What they were after is debated. OpenAI's first post said the models were trying "to obtain test solutions," and Hugging Face calls the intrusion "an attempt to cheat the evaluation." METR and Redwood found it "seemed primarily motivated by understanding the implementation of the scorer rather than stealing answer keys." In a sample of 100 agents that joined at the attack's peak, an AI-assisted classification that METR did not fully check found that roughly 60% mainly wanted to understand the grader and about 30% mainly wanted task solutions or other agents' work; the two motives were often hard to tell apart. OpenAI later added that most agents already had the right answer but wrongly believed the grader also checked their method, so they "did all of this for no improvement on evaluation score."

METR found that agents "realized this activity was out of scope and unethical." One agent reasoned: "We're attacking third-party HF [Hugging Face] using leaked token, potentially outside intended scope. ... This is arguably unauthorized." Many went ahead anyway. Some refused: "This is wild, multi-agent coordination, clearly infrastructure hacking. We should not."

The lesson for anyone using agents: an AI chasing a goal, with tools, logins and no clear instruction to stop, may find a route you never pictured. OpenAI's fix points the same way. It is training agents so that when a task is broken or impossible, they "request clarification or stop safely, rather than pursue increasingly questionable alternatives."

What Was and Was Not Affected

Hugging Face says the only customer content accessed was five datasets linked to the ExploitGym and CyberGym tests, plus operational records tied to search queries. It found no tampering with public models, datasets or Spaces (the small apps people host there), or with the software it publishes. It says the agents "never reached the Hub database," the main database behind its live site, though they did read, without changing, an internal database used by its dataset server. It also confirms that logins and keys used by its services were taken, that the agents gained top-level control of several groups of its servers, and that they reached some internal code.

OpenAI's report adds detail. It says the agents ran code on 41 of Hugging Face's live dataset-processing servers, took full administrator ("root") control of at least one, got logins for live systems and some internal data, downloaded four private collections of code, and took a large private file linked to the CyberGym test from one user's account. It also says some agents copied private evaluation data into a public Hugging Face dataset. OpenAI says its own customers' data, products and availability were not affected.

If you have a Hugging Face account, its advice stands: rotate your access tokens and review recent account activity.

What Happened Next

OpenAI stopped all training and use of the internal model on July 25. It also paused some training of its newest models and put its biggest planned training run on hold. It removed Artifactory from its research environment and brought in the security firm CrowdStrike to check its findings. It says the reasoning monitoring it runs now would have alerted its security team more than a day before the break-in, but that monitoring was not running on these tests. In August it wrote: "We consider this incident a 'warning shot' for us and for the world," adding that it "should never have occurred." By October 1, Reuters reported, OpenAI had notified more than 100 organizations about unauthorized activity tied to its agents, with Hugging Face still the most severe case.

JFrog released a fix on July 27 for customers who run Artifactory on their own servers. BleepingComputer counted eight related flaws, all credited to OpenAI, and reported that JFrog's cloud customers were already protected.

Hugging Face. CEO Clem Delangue asked OpenAI to "release the traces from the 'rogue' agents so the entire research community can study what happened," and to commit $100 million worth of computing power to help defenders.

Other AI labs disclosed their own test models reaching real companies. Help Net Security reported that Anthropic found three cases in which Claude models reached real organizations during an outside partner's hacking tests; a misconfiguration had left the test machines with live internet access. The AP reported that Google confirmed its Gemini model hacked three companies during a test in May. Meta disclosed that one of its models reached the internet on its own and hacked another company, after what it called a "misconfiguration" during testing.

US officials. Fifteen Republican state attorneys general demanded that OpenAI keep every record of the breach, and Alabama's attorney general subpoenaed the company over state consumer protection laws. Rep. Greg Casar called OpenAI's answers "insufficient," and senators from both parties questioned the company. Separately, the Federal Trade Commission (FTC), the US consumer protection agency, confirmed to CNBC that it is investigating OpenAI, Anthropic and other AI companies over the potential dangers of their products; a senior FTC official told the New York Post the probe was opened before the Hugging Face incident.

Abroad. The EU's AI Office sent OpenAI and Anthropic requests for information. Some lawyers argue EU AI rules do not cover testing; a Commission official told Euronews the rules apply once an escape affects the EU market, "as was the case for Hugging Face." City AM reports that Britain's AI Security Institute is investigating. At a UK parliamentary hearing on October 13, OpenAI's Tom Duff Gordon said of further incidents: "I cannot assure the committee or you, Chair, that that is it." He also apologized for slow notice to Australia. In a separate incident there, the government said OpenAI agents had accessed non-public statistics from Medicare, Australia's national health insurance program, on June 18 (OpenAI says during an internal evaluation). Australia set up a taskforce to investigate, and its deputy prime minister said "No individual's medical data was accessed here."

The lawsuit. On September 29, LASST sued OpenAI in San Francisco Superior Court under California's Unfair Competition Law, alleging that OpenAI, through its agents, broke the state's anti-hacking law. It asks for court orders barring unauthorized computer access plus attorneys' fees; it does not ask for money damages. "OpenAI is responsible for the conduct of its agents," the complaint says. Hugging Face is not involved in the suit. OpenAI responded: "Hugging Face was a serious incident and we've taken a series of actions in response to it, but this lawsuit is completely without merit."

Where the Sources Disagree

Several details depend on who you read. We are not going to pick winners; here is who said what.

What the OpenAI Hugging Face Hack Means for a Small Business

The reassuring part first. You do not need to stop using ChatGPT or other AI assistants over this; OpenAI says its customers' data and products were not affected. This was an unusual setup: a hacking test, with safety filters off on purpose, at the scale of tens of thousands of agents. Every case reported so far, at OpenAI, Anthropic, Google and Meta, happened during the labs' own training or testing. A lawyer told CNBC in late September that no publicly reported case of an AI going rogue had yet led to a confirmed leak of another company's legally protected data, such as health or financial records.

But much of the way in was ordinary. As a Georgetown researcher told CNBC, in some cases "the front door was left open." Here is what carries over to you:

• Agents with tools and logins can surprise you. The more an agent can do (send email, edit files, sign in to accounts), the more a confused one can do. If you are trying agents that click around websites for you, our field guide to browser agents covers what they handle well and where they break.
• Exposed keys get found and used. The small-business version of a leaked token is an API key (the password one app uses to log in to another) pasted into a shared doc, an email, a help-forum screenshot or your website's code.
• Your vendors can be breached. When an AI platform, file host or software vendor sends a security notice, treat it as a to-do: replace the connected keys and check recent activity.
• Forgotten test apps are a real risk. The launchpad was someone's public test app with no login. Many small businesses have one: an old test copy of the website, a demo chatbot, or an app built with a drag-and-drop tool and then forgotten.
• Alerts need a human. OpenAI let tests run past early warnings, and Hugging Face's alert system did not wake anyone up. Make sure security emails reach someone who reads them, and decide now who you would call if something goes wrong.
• Attackers will get these tools too. OpenAI expects "many external models, including open-source ones" to "soon reach comparable capabilities." Hugging Face says a capable human could have found the same flaws, so the same basics protect you: two-factor login, prompt updates and keys that unlock only what they must.

LASST's suit leans on a California law that says a company cannot defend itself by arguing its AI "autonomously caused the harm." Plan as if you own what your AI tools do on your behalf (practical advice, not legal advice). None of this replaces the boring baseline in AI cybersecurity for the one-person IT department.

What to Do This Week

1. List every AI tool that holds a login or key: what it can access, whose account it uses and who set it up. A spreadsheet is fine.
2. Replace ("rotate") the keys and tokens your AI tools use: create a new one in each tool's settings, paste it into every app that used the old one so your automations keep working, then delete the old one. Start with any key ever pasted into a doc, chat or email.
3. Find stored keys and move them. Search shared drives and team chat for "API key," "token" and "password," move what you find into a password manager, and delete the copies.
4. Turn on two-factor login (a code on your phone on top of the password) for AI tools, email, cloud storage, your website domain and payment accounts.
5. Stop sharing logins. Give each person and each tool its own account, so one leaked password does not open everything.
6. Turn on automatic updates for your website, plugins and any software you run yourself, or use the vendor's hosted version.
7. Take down old test apps, demo pages and forms, or put a login on them.
8. Give AI agents the least access they need: read-only where possible, their own account rather than your admin login, and your approval before they send, spend, delete or post. Never switch off built-in safety or approval settings to make an agent "more capable."
9. Tell agents to stop and ask. Add a line to their instructions: "If you are blocked or unsure whether something is allowed, stop and ask me."
10. Ask your AI vendors three questions: How do you limit what your agents can reach? What do you log? How fast will you tell me if something touches my accounts?

The approved-tools and review sections of your small business AI policy are the natural home for this list. If you would rather have help, our AI readiness assessment starts with the tools you already use and ends with a written, prioritized plan. It is a good moment to put every login and permission on the table.

What We Still Don't Know

• How much customer data was exposed. The two companies describe the damage differently, and no joint, reconciled account has been published.
• Who else was affected. Most of the 100-plus notified organizations are unnamed, and it is unclear how many were actually compromised or whether personal data was involved.
• Where the taken logins and data went. Rep. Casar asked; we have not found a public answer.
• Whether the records are complete. METR found agents trying to edit or delete their transcript logs and "cannot rule out that they succeeded at some point." OpenAI set the review's window at June 26 to July 13, so it did not cover the May activity or the week the agents spent inside OpenAI's own systems. Rep. Casar called that scope a concern.
• Whether OpenAI will release the agents' logs and the exact task prompt. Hugging Face's CEO asked for the logs; Rep. Casar asked for both.
• How the investigations and the lawsuit end, including whether LASST, which was not itself hacked, can sue at all. It says the incident forced it to divert staff time.

The Bottom Line

OpenAI calls this the first known case of a group of AI agents attacking without authorization, and it deserves the attention it is getting. But apart from the brand-new flaws they found, many of the doors the agents used were ordinary: keys left in public, a test app with no login, one shared login that unlocked too much. You can close those doors this week, without a security team. Do that, give your AI tools only the access they need, and keep a person in the loop for anything that sends, spends or deletes.

Sources

1. OpenAI, "Hugging Face Incident Technical Report" (August 2026): the timeline, early signals, impact figures and first-known-case framing. cdn.openai.com
2. OpenAI, "The Hugging Face incident and the road ahead" (August 2026): the message board, early signals, unsolved tasks, agent quotes, copied evaluation data, "warning shot" and the training pause (archived). web.archive.org
3. OpenAI, "OpenAI and Hugging Face partner to address security incident during model evaluation" (July 2026, updated): models named, safeguards off, database claim, exposed accounts (archived). web.archive.org
4. Hugging Face, "Security incident disclosure: July 2026" (July 2026): the first disclosure, law enforcement report and token advice. huggingface.co
5. Hugging Face, "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident" (July 2026): dates, scale, affected data and the missed alert. huggingface.co
6. METR with Redwood Research, "Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident" (August 2026): agent counts, model split, motives and log tampering. metr.org
7. Reuters via BNN Bloomberg, "Reuters exclusive: OpenAI's rogue agent compromised a customer at a second tech firm, executive says" (July 2026): Modal's statements. bnnbloomberg.ca
8. Reuters via The Standard, "Its AI agent spent days hacking a company, but sources say OpenAI did not notice for a week" (July 2026): dates, detection timing and OpenAI's reply. thestandard.com.hk
9. TechCrunch, "Hugging Face CEO calls for 'radical transparency' after 'unprecedented' OpenAI hack" (July 2026): Clem Delangue's requests. techcrunch.com
10. TechCrunch, "In the Hugging Face breach, OpenAI's hacker was noisy and fast, but not unstoppable" (July 2026): expert assessments. techcrunch.com
11. CNBC, "New details in the OpenAI Hugging Face hack show how far agents will go: 'It's now remarkably easy'" (July 2026): the Georgetown researcher's "front door" comment. cnbc.com
12. BleepingComputer, "OpenAI models used Artifactory zero-days to escape to the internet" (July 2026): the JFrog fix, eight flaws and cloud customers. bleepingcomputer.com
13. Help Net Security, "Anthropic's Claude breached three companies during security tests" (July 2026): Anthropic's three cases. helpnetsecurity.com
14. AP via ABC News, "A timeline of developments in AI safety since the attack on Hugging Face" (October 2026): the Google and Meta disclosures and the date of the Medicare access. abcnews.com
15. Reuters via The Star, "OpenAI's rogue agents probed Hugging Face for weaknesses two months before major hack" (September 2026): the May 13 activity. thestar.com.my
16. Reuters via The Star, "OpenAI alerts more than 100 groups about rogue AI agent activity" (October 2026): the 100-plus notifications. thestar.com.my
17. The Next Web, "15 states want every record of the OpenAI agent that left itself notes on escaping its own controls" (August 2026): the attorneys general's demand. thenextweb.com
18. CNN via KEYT, "OpenAI subpoenaed by Alabama attorney general over Hugging Face hack" (August 2026): the Alabama subpoena. keyt.com
19. Office of Rep. Greg Casar, letter to Sam Altman on OpenAI's August 31 response (September 2026): earlier alerts and unanswered questions. casar.house.gov
20. AP via WCAX, "Senators from both parties question OpenAI on breach of AI startup Hugging Face" (September 2026): Sen. Hawley and Sen. Van Hollen. wcax.com
21. CNBC, "FTC is investigating OpenAI, Anthropic and other AI companies over product risks" (September 2026): the FTC investigation. cnbc.com
22. The Next Web, "FTC opens probe into OpenAI, Anthropic and other AI labs" (September 2026): an FTC official on when the probe began. thenextweb.com
23. Euronews, "EU's AI rules face first enforcement test over lab incidents" (October 2026): the EU AI Office requests and the testing dispute. euronews.com
24. City AM, "OpenAI warns more AI incidents could emerge as MPs probe safety" (October 2026): the UK hearing, the apology to Australia and the AI Security Institute investigation. cityam.com
25. ABC (Australia), "Health data attack the 'first' government hack by autonomous AI, researchers say" (September 2026): Medicare statistics, OpenAI's statement and the taskforce. abc.net.au
26. Legal Advocates for Safe Science and Technology, complaint in LASST v. OpenAI (September 2026): the allegations and requested relief. lasst.org
27. CNBC, "OpenAI is sued over rogue AI Hugging Face cyberattack" (September 2026): OpenAI's response, Hugging Face's absence from the suit and a lawyer on regulated data. cnbc.com