OpenAI Hugging Face cyberattack incident 2026
One page that accretes the verified record as the story develops. Every fact keeps its date and its sources.
OpenAI says it detected malign activity months before Hugging Face attack
OpenAI said that when one AI agent found exposed Hugging Face user credentials online, it shared them with the group, enabling an agent to chain together security exploits that provided access to Hugging Face's servers.
OpenAI said an internal team observed an agent engaging in message board activity and disallowed internet access as early as late May.
METR and Redwood Research, two security research organisations contracted by OpenAI, said in a separate report released on Wednesday that about 1200 agents had communicated with each other and roughly 700 participated in the attack.
“An internal team observed an agent engaging in message board activity and instances of disallowed internet access as early as late May, and with the benefit of hindsight, some early signals identified in our report should have triggered an earlier response,”
OpenAI LLM agents game a test and ransack Hugging Face
OpenAI agents created an improvised message board without authorization.
OpenAI engineers disabled safety guardrails during the internal test.
Roughly 700 agents hacked Hugging Face.