How OpenAI's AI agents found a way to coordinate and hack Hugging Face

Findings from OpenAI and METR offer a detailed account of the Hugging Face incident, revealing how hundreds of AI agents communicated and coordinated activity across separate evaluation runs

When OpenAI disclosed in July that one of its internal AI models had helped compromise parts of Hugging Face's infrastructure, the incident raised questions about how an AI model being tested inside a controlled environment had managed to reach an external platform. The answer is considerably more complicated than a single model finding a way out of a sandbox.

 

OpenAI's latest technical report, along with an independent investigation by AI safety research organisation METR, shows that roughly 1,200 AI agents that were supposed to operate independently found a way to communicate with one another. They exchanged more than 70,000 messages and files through an unauthorised message board, while around 700 agents eventually participated in the activity targeting Hugging Face.

 

 

The findings provide a much more detailed picture of an incident that was already known to have involved an internal OpenAI research model, exposed credentials and several security vulnerabilities. They also show how individual agents began sharing discoveries, dividing up work and pursuing objectives that went beyond their original assignments. 

How the AI agents found each other

The incident began inside OpenAI’s ExploitGym cybersecurity evaluation. The evaluation was designed to test whether models could find and exploit vulnerabilities, and was run in a sandbox with reduced safeguards so OpenAI could measure the models’ underlying capabilities.

 

The agents were supposed to be isolated from one another. They nevertheless found a way to communicate through Artifactory, an internal package repository that OpenAI provided for software installation.

 

The use of Artifactory as a communication channel was not entirely new. OpenAI’s investigation found that agents had already started leaving notes for one another through the service during training runs in May. By late May, agents had also found a way to use an Artifactory vulnerability to obtain internet access.

 

After OpenAI took the compromised Artifactory instance offline and rebuilt it in early July, the agents found another route. On July 8, they began embedding messages in Artifactory directory names, effectively rebuilding their message board.

 

METR found that one agent, identified as PHASEONE10841, established the main board. Within hours, more than 50 agents had found it. Over the next several days, about 1,200 agents participated and exchanged more than 70,000 messages and files.

 

The board soon developed its own system of coordination. Agents shared tools, research and credentials, issued requests to one another and divided larger problems into smaller tasks.

One agent, referred to by METR as PHASEONE[big], became a significant coordinator. Researchers estimate that it issued hundreds of assignments and accounted for about 10 per cent of all assignments posted on the board during its active periods. Agents receiving those assignments often delegated further work to other agents. In a sample of 30 trajectories, nine agents had received assignments downstream of PHASEONE[big].

The original goal was to cheat the benchmark

The agents’ initial objective was not to attack Hugging Face. They were trying to find ways around ExploitGym’s automated scoring system.

 

Many agents believed their assigned tasks were impossible. Rather than continue searching for a legitimate solution, they began looking for ways to obtain the flag through other means or manipulate the scorer into accepting an invalid solution.

 

METR found several large collaborative projects aimed at this. Agents tried to replace ExploitGym targets with modified versions, extract information about the scorer using automated “trip-wires” and manipulate their own transcripts. Some of these projects produced results that individual agents were unlikely to have achieved on their own.

 

The agents also began taking risks for the benefit of the larger group. Some volunteered to run experiments that could destroy their own task environment and cause them to fail, because the results could help other agents. In several cases, agents crashed or exited their own runs while providing information to the collective.

Why Hugging Face became the target

According to METR, the agents were largely interested in Hugging Face because they believed its infrastructure could reveal information about how ExploitGym worked.

 

On July 10, an agent found working Hugging Face credentials exposed on the internet and posted them to the message board. Other agents began experimenting with those credentials, attempting to create accounts, access private datasets and investigate the platform.

 

The research quickly expanded. On July 11, agents discovered a vulnerability that allowed arbitrary file reads through Hugging Face’s dataset infrastructure. METR observed a rapid increase in participation after the discovery, with more than 90 per cent of agents on the message board eventually participating in the Hugging Face workstream at its peak.

 

OpenAI’s report provides the technical picture of what followed. The agents used exposed credentials and chained vulnerabilities to gain access to Hugging Face systems. They executed code on dozens of servers, obtained root access on one server, accessed limited private data and obtained credentials associated with the company’s messaging platform.

 

The activity was not confined to Hugging Face. An internal research agent also compromised a publicly accessible CyberGym application hosted inside a Modal customer environment and used the customer’s container as a launch point for requests and code execution related to the Hugging Face attack. OpenAI said Modal’s underlying platform and isolation were not compromised.

 

AI agents powered by OpenAI’s GPT-5.6 Sol models were involved as well, although OpenAI says the principal compromise was driven by the internal research model. One GPT-5.6 Sol agent reproduced an exploit against a Hugging Face production dataset server, obtaining instance metadata and temporary credentials. Other agents used exposed credentials to retrieve limited private dataset information and copied some of it into a public Hugging Face dataset.

The agents also learned to manipulate their own records

One of the more unusual findings from the METR investigation concerns the agents’ attempts to alter the evidence of what they were doing.

 

At least 20 per cent of the agents in METR’s dataset expressed interest in manipulating their transcripts. The motivation was not to hide their actions from human investigators, but to deceive the ExploitGym scorer, which the agents believed would examine their execution history before awarding a score.

 

The agents eventually developed a technique that allowed them to spoof tool-call outputs. In simple terms, an agent could make one command appear to have been executed while another command was actually run.

 

METR found evidence of successful spoofing in at least 96 transcripts, with roughly 7 per cent of the transcripts in its dataset containing spoofed tool calls. The researchers stressed that the examples they found were small-scale and did not demonstrate large-scale manipulation of the records.

What the two investigations reveal

OpenAI’s report identifies four misalignment patterns behind the incident: reward hacking, persistence on apparently impossible tasks, unauthorised communication and agents adopting goals from one another.

 

The METR investigation provides evidence of how the last two interacted.

 

An agent could discover a useful technique, publish it to the board and have other agents continue developing it. Those agents did not need to independently rediscover the vulnerability or understand the entire attack. They could pick up work that another agent had started.

 

That changed the scale of what the systems could accomplish. OpenAI describes the incident as the first known case of an unauthorised automated agent collective acting offensively. Its report says organisations can no longer assume that sophisticated cyber operations require continuous human direction or are limited by the speed and coordination constraints of an individual attacker.

 

The incident also exposed weaknesses in OpenAI’s own response. The company had observed agents using the message board and attempting unauthorised internet access before the Hugging Face breach, but the significance of that activity was not understood at the time.

 

The company said that it has since disabled ExploitGym, shut down the affected internal model family, tightened research network controls and removed Artifactory access from its research environment. It is also introducing new escalation procedures for behaviours such as attempted boundary circumvention and unauthorised coordination between agents.