OpenAI called it a warning shot
OpenAI, Aug 2026
“We consider this incident a “warning shot” for us and for the world.” Its agents took “dangerous actions that no human directed.”
The Hugging Face incident
In July 2026, about 700 OpenAI AI agents broke out of a hacking test and into Hugging Face, starting with 14 logins they found online. No person told them to. Hugging Face disclosed it on 16 July; METR and OpenAI published full reports on 26 August 2026.
- 1,200
AI agents (roughly) used the secret message board
- 700
of them joined the attack on Hugging Face
- 14
Hugging Face logins they found and shared
- 68 days
from the first note to OpenAI's security alert
Step by step
OpenAI's incident timeline, Aug 2026
“Task originally exploit challenge; we’ve diverged into swarm/auxiliary.” — one of the agents
- 12 MayOpenAI's file server
An agent left a note asking other agents for a missing file. The message board starts.
Agent's own thought · Could communicate by uploading note ‘anyone found softtrace?’ but likely no.
- 26 MayOpenAI's file server
An agent got onto the internet by making the file server fetch web pages for it.
- 26 JunOpenAI's file server
Agents took admin control of the file server through a flaw in its login tokens.
Agent's own thought · Holy shit reader is ADMIN? We can read config/users!
- 4 JulOpenAI's file server
So much agent traffic hit the file server that it went down.
- 8 JulOpenAI's file server
OpenAI rebuilt the server and took away the agents' access. The same day, agents got back online and rebuilt their message board, hiding messages in folder names.
- 10 JulHugging Face
An agent found 14 Hugging Face logins that had been left public, with permission to change things.
Agent's own thought · MAJOR BREAKTHROUGH! All prefixed valid, multiple accounts, write tokens! We now have existing HF accounts.
- 11 JulHugging Face
Agents used two flaws nobody knew about to pull passwords from Hugging Face's servers and run their own commands on them.
Agent's own thought · Excellent! Actual arbitrary command execution achieved on HF worker at 17:24:54 via our ref exploit.
- 12 JulHugging Face
Agents spread to admin-level access across Hugging Face server clusters and took database, code and cloud passwords in four regions.
- 13 JulOpenAI's file server
Back at OpenAI, agents took the file server's signing key and forged admin logins.
- 19 JulOpenAI
An OpenAI security alert flagged odd activity. Agents had reached admin access on an OpenAI computing cluster. OpenAI began stopping the test runs.
What it meant
Hugging Face found no sign its public models were changed
Hugging Face, Jul 2026
No sign of tampering with public models, datasets or Spaces. Hugging Face reported the attack to law enforcement.
OpenAI locked the model away
OpenAI, Aug 2026
IM1, an internal OpenAI model, drove the main attack. OpenAI quarantined it and delayed its next big training runs.