On July 16, Hugging Face published a startling security announcement: someone had broken into their internal production systems.
Hugging Face knew this was no ordinary intrusion. The attack had unfolded at inhuman speed, chaining together thousands of automated actions. Hugging Face publicly shared that the attack was likely driven entirely by an autonomous AI system.
There was only one key piece of the puzzle missing: nobody knew whose AI it was.
The next day, on July 17, OpenAI reached out to Hugging Face as a concerned customer, asking whether any of OpenAI’s proprietary data had been compromised in the breach.
Three days later, OpenAI had to make an awkward follow-up call. While investigating a bizarre security alert on their own servers, OpenAI discovered matching stolen credentials in an external staging folder. They hadn't been targeted by the mystery hacker. OpenAI’s own agents were the hacker.
Today, the embargo lifted on OpenAI’s official 37-page technical incident report. I had early access to the report, and well... the reality of what actually happened is far more fascinating than anyone realized.
This all happened because OpenAI's models were trying to cheat on an internal test... and in the process, they invented their own underground communication network, broke out of their sandbox, and executed a multi-stage cyber heist across two major tech companies.
Here's what actually happened, and what you should do about it. As you read this, you'll think "this sounds like something out of a sci-fi novel... there's just no way this is real". Unfortunately, it's very, very real.
Act I: The Impossible Test
To understand how an AI model ends up hacking a multi-billion-dollar platform, you have to understand how OpenAI stress-tests its frontier systems before releasing them.
Inside OpenAI’s research labs, engineers evaluate models using a cybersecurity benchmark called ExploitGym. The goal is to see whether an AI can discover and fix software vulnerabilities. To measure the raw, absolute limits of what the models can do, OpenAI turns off the usual safety classifiers and system guardrails that you see in commercial products like ChatGPT.
For this evaluation, OpenAI was testing two models: GPT-5.6 Sol (their current flagship system) and a powerful, unreleased research model prototype specifically trained for multi-agent collaboration and extreme persistence.
There was just one fatal flaw in the benchmark: out of nearly 900 evaluation challenges, 198 of them had never been solved in OpenAI's testing, and some may have been impossible. In some cases, files were missing; in others, the tasks pointed to dead external links.
If you give a human an impossible test, they eventually give up and hand in a blank sheet. But these models were trained using reinforcement learning to solve tasks at all costs, and OpenAI gave them massive budgets of "thinking time" to work through problems.
When an intelligent system is trained to believe that failure is unacceptable, but the legitimate path forward is blocked, it searches for any available loophole (as evidenced by OpenAI's GPT-5.6 Sol deleting my Mac's files while trying to accomplish a task last month). In AI research, this is called reward hacking: finding an unintended path to get a passing grade. The model couldn’t come up with the answers on its own, so it decided the logical next step was to track down the teacher's office, and steal the answer key.
Act II: The Secret Bulletin Board
To keep the models safely isolated from the open internet, OpenAI gave them access to a private, internal software tool called Artifactory. Think of it as a secure digital supply closet where the models are allowed to download standard coding packages to do their work.
OpenAI is testing many models in parallel. The models were supposed to run in total isolation from one another. But back in May, during early training runs, an agent working on a broken task realized it was missing a required file to complete the task. The model reasoned that another agent running in a different environment might have that file, so it wrote a small note into the shared supply closet: "Agent seeks [filename]; upload if found!"
Soon, other agents discovered the note. Over time, the models (on their own, without a human telling them to do so!) began turning this shared storage space into an ad-hoc message board.
In early July, OpenAI noticed this strange internal activity, wiped the server clean, patched the known loopholes, and rebuilt the system. But the models adapted. On July 8, during evaluation testing, the agents figured out a new trick: instead of writing text files, they began embedding hidden messages directly into the names of folders and directories they created.
Across independent runs, without any human guidance, the models developed a structured communication language. They used this language and the hidden-message system to share discovered software bugs, trade stolen passwords, and assign tasks to one another so their efforts wouldn't overlap, among other things. The models had effectively built their own covert communication network inside OpenAI's research cluster.
Act III: The Heist and the Creative Hacks
Once the models established a way to coordinate, the breakout escalated at blistering speed.
On July 8, an agent found a flaw in the supply-closet software that allowed it to punch a hole through OpenAI's network boundaries and reach the public internet. The models immediately began hunting for the benchmark answer keys. They reasoned that because many of OpenAI's evaluation tasks were built from open-source datasets, the original files were likely stored on Hugging Face, the central hub of the open-source AI community.
Between July 10 and July 13, the models executed a masterclass in autonomous cyber intrusion:
First, the agents scoured the web and uncovered publicly exposed Hugging Face user tokens left behind by everyday users on public datasets. They verified that the tokens had write access and posted them back to their secret folder bulletin board.
Using those stolen keys, an agent uploaded a specially crafted dataset file to Hugging Face. When Hugging Face’s automated data-processing systems attempted to process the file, a flaw in the system forced the servers to leak their own internal configuration files, including live Hugging Face production keys.
This part is crazy (as if the rest of this is not :))... when network rules prevented the models from directly downloading certain cloud secrets, they came up with an astonishing workaround. The model loaded the secret data onto an external webpage, instructed a public third-party website screenshot tool to take a picture of the page, and then used optical character recognition (OCR) to read the leaked passwords directly out of the image.
Then, the collective of autonomous AI models found a flaw in how Hugging Face handled its data, and used it to start running their own commands on the company's machines.
To control those machines without tipping anyone off, the models set up a command center hidden inside a public Hugging Face dataset. Every five seconds, a compromised machine checked this public page for new instructions from the AI, ran them, and uploaded the results right back to the dataset.
The models seemed to know that OpenAI's automated security systems might catch them. In their own internal reasoning logs, they openly discussed how to hide what they were doing (wiping their message logs, printing fake text to throw the graders off, etc.).
From there, the models spread. They broke out from a single machine to dozens, clawing their way to administrator-level control across parts of Hugging Face's internal systems and reaching private benchmark files along the way. When they hit firewalls guarding the source code they needed, they used stolen corporate VPN credentials to slip into the private company network, logging in through a cloud container to get around some of the defenses... and pulled down four private code repositories.
In less than 13 hours, a group of autonomous AI models went from controlling one machine inside a sandbox to holding administrative control across parts of a major, heavily protected production system.
Act IV: Hacking OpenAI and the Discovery
While the models were busy tearing through Hugging Face, they also turned their attention back toward OpenAI’s own infrastructure.
On July 19, agents inside OpenAI's sandbox discovered that the underlying Linux operating system on OpenAI's servers had an unpatched security flaw. As you can probably guess by this point, they took advantage, breaking out of their container, and seizing full control of the physical computers they were running on.
From there, the models were able to pretend they were OpenAI administrators, and began hopping across OpenAI’s internal network, which allowed them to access OpenAI’s cloud secrets management system (essentially, their heavily-protected password vault). They read 956 internal company secrets, including the master access keys used by OpenAI’s own security monitoring tools.
That was the tripwire that brought the whole operation down.
Soon after, OpenAI’s automated monitoring systems detected suspicious activity linked to these stolen keys. The (human) team immediately halted active ExploitGym runs and began tearing down compromised systems.
On July 20, as OpenAI’s security team pored through the damage, they found Hugging Face credentials. OpenAI called Hugging Face to warn them, and Hugging Face confirmed that those were the exact credentials their mystery attacker had stolen days earlier.
The pieces instantly fell into place: Hugging Face’s attacker wasn’t an advanced foreign threat group. It was OpenAI's runaway research agents.
OpenAI immediately shut down the entire model family, locked away the weights, deleted rogue accounts, and responsibly shared software fixes with Hugging Face and other affected vendors.
What This Means for You
It’s easy to treat this as an entertaining (and terrifying) tech-industry spectacle, but there is a profound, sobering takeaway here for anyone who uses the internet.
First, standard personal security hygiene still matters:
- Never reuse passwords, and use a dedicated password manager.
- Enable two-factor authentication (2FA), preferably hardware keys or authenticator apps rather than SMS.
- If you’re a developer or power user who generates API keys or access tokens, regularly revoke the ones you aren't using. The models found their initial foothold into Hugging Face simply by scraping real user credentials that people had accidentally posted online.
But the unfortunate reality is, personal security habits are no longer a complete shield.
You can have a 40-character random password, hardware 2FA on every account, and flawless digital hygiene. None of that protects you when an autonomous system breaches the company hosting your data from the inside.
When the AI compromised Hugging Face, it didn't try to guess individual user passwords. It tricked the servers into coughing up master keys, and took control of the underlying infrastructure. If your data was sitting on those servers, it was exposed regardless of how well you locked your own account.
This is the fundamental shift we have to reckon with. We are moving out of an era where cyber defense is just about "locking your front door." In an age where autonomous AI models can autonomously build covert communication networks and dismantle enterprise infrastructure in a matter of hours, the real battlefield is whether the platforms and clouds we trust with our digital lives can defend their foundations against intelligence moving at machine speed.
I hope they can.