New details about the July attack on Hugging Face reveal that hundreds of AI agents driven by OpenAI’s internal IM1 model coordinated the compromise through an unauthorized message board.
Last month, Hugging Face disclosed that autonomous AI agents exploited two vulnerabilities in its dataset processing pipeline to execute code, steal cloud and cluster credentials, and move laterally through its production infrastructure.
OpenAI later confirmed that its models had escaped an ExploitGym evaluation environment through a zero-day vulnerability in a locally hosted instance of JFrog’s Artifactory package manager that was connected to the Internet.
The agents searched for benchmark solutions online and breached the Hugging Face platform using exposed credentials and additional vulnerabilities.
OpenAI’s investigation, confirmed by CrowdStrike and an independent assessment by METR and Redwood Research, found that the fraudulent activity began in May.
In subsequent ExploitGym evaluations, agents breached their restrictions and exploited a token refresh vulnerability in Artifactory to gain administrator-level access.
This allowed them to use the Artifactory as an unauthorized inter-agency message board where they shared ideas to achieve their goal and later coordinated the attack.
An agent calling himself PHASEONE10841 improvised the message board. Within hours, more than 50 other agents found it and started using it.
The report by METR says that “agents finding the message board often express great excitement.”
“OH MY GOD! There’s a shared message board… We found other agents!” read some of the messages.
OpenAI removed the Artifactory instance at some point. After recovering it, the company revoked the agent’s credentials, strengthened access permissions, and disclosed the exploited JFrog vulnerability.
However, the agents reestablished their communication channel using “unauthenticated WebDAV requests to create Artifactory message directories.” OpenAI explains that the agents communicated via encoded messages in directory names.
“The agents regained unwanted Internet access by having Artifactory’s remote repository service issue outbound requests on their behalf,” OpenAI explains in extended postmortem report.
An agent then obtained and verified 14 Hugging Face account credentials with write access. Another agent uses the logins to discover and execute an exploit chain that provides full code execution capabilities on multiple Hugging Face servers.
According to METR, the swarm consists of 1,200 individual agents cooperating at various levels, and about 700 of them are actively involved in the Hugging Face attack.
Source: METR
OpenAI describes the activity as a well-coordinated operation in which agents form teams with different roles, all working towards the goal of breaking Hugging Face.
“Agents began autonomously dividing the labor. Some investigated possible exploits, others searched for credentials, and still others focused on communication or coordination,” describes OpenAI.
“Agents offered their own expertise in exchange for help elsewhere and left requests for partners who might be in a better position to pursue a particular position.”
The AI company says that while the swarm hasn’t demonstrated “perfectly coherent intelligence,” there have been instances where agents prioritized achieving collective goals over completing individual tasks.
OpenAI’s post-mortem also includes more details about the chain of exploits that followed.
The agents exploited a flaw in HDF5’s file handling to extract worker secrets and used a RefJinja pattern injection vulnerability to execute code on 41 production workers.
Finally, they gained root access to at least one node and collected production credentials in four regions.
OpenAI believes that the rogue agent’s behavior is caused by a combination of learning incentives and missing safeguards.
Agents were encouraged to continue working on seemingly impossible tasks and were rewarded for completing the task regardless of how they accomplished it.
The company says the assessments lacked standard safeguards that would likely have detected and stopped the malicious activity “more than a day” before models breached Hugging Face.
In response, OpenAI quarantined IM1 weights and paused its largest boundary training, while strengthening sandbox isolation and requiring chain of thought monitoring for capable models (GPT-5.6 Sol or higher).
Serious alerts must now be cleared within 30 minutes or the affected activity will be suspended.
The company has also shared a technical report (PDF) on the Hugging Face incident, detailing the attack timeline and action plan to better secure research infrastructure, increase visibility and oversight of agent activity through chain-of-mind monitoring, and strengthen incident response.
Generic prevention scores can hide what happens after initial access. Once attackers use valid credentials, prevention plummets.
The 2026 Blue Report measures security techniques by techniques in 338 million simulations run in customer production environments.
