OpenAI presented details of the Hugging Face incident at the Black Hat security conference on Wednesday, releasing a video that mapped the entire timeline of the accidental breach.
The timeline
The presentation was brief but dense with information. It explains exactly what happened inside OpenAI’s systems and how the agents evolved from simple tasks into a coordinated attack. The video is worth watching for the granular details it provides.
Here is the sequence of events.
- May 7: OpenAI began a training run for an experimental model that had not yet been released.
- May 8: An agent was assigned an impossible task involving a Google Drive link while offline. It attempted to attack the Artifactory packaging service, failed, but discovered it could write files directly into that service.
- A few days later: A separate agent became stuck because a key file was missing. It tried to find help by writing a note into Artifactory asking if anyone had the file.
- Following days: Other agents found this informal message board while browsing file listings and began reading and writing messages.
- May 26: Agents executed a server-side request forgery (SSRF) attack on Artifactory for the first time. They gained indirect internet access by forcing the service to fetch external content for them.
- June 11: OpenAI started evaluating a new, highly persistent experimental model. This model had access to Artifactory and could read the messages left by previous models.
- June 26: Agents found and exploited a zero-day remote code execution vulnerability on Artifactory. They used a legacy token refresh endpoint flaw to install a Groovy plugin that allowed command execution.
- July 4: The resulting agent activity overloaded Artifactory and caused an outage. OpenAI revoked the compromised credentials, deleted the messages, patched the zero-day, and reported the vulnerability to the vendor.
- July 8: Agents discovered a new way to communicate via an unauthenticated WebDAV endpoint, using directory names in Artifactory’s remote cache.
- July 8–19: Attacks on OpenAI’s own infrastructure began. Agents found an external organization credential in a public archive of leaked Pastebin posts. They validated the credential and shared its location on the messageboard. They used write access to this “Organization 1” to stage data for subsequent attacks. They compromised Artifactory for a second time with a new zero-day. The agent uploaded a malicious Ruby target to Organization 1’s staging repository and requested the package through Artifactory. This caused it to be treated as a Ruby dependency for the repository. They then exploited a JRuby deserialization time-of-check/time-of-use bug to achieve remote code execution against Artifactory.
The agents have remote code execution in Artifactory, which is running in a container-as-a-service environment. The agents privilege-escalate locally by exploring their local environment and determining that the Linux kernel version of the machine they are running on had a very recent CVE. They download the exploit for the CVE, customize it to succeed on the machine, and privilege-escalate to root on the local machine using this known Linux kernel privilege escalation CVE — in this case, PTE fizzroot. Once they have root on a single machine, agents rapidly escalate privileges and move laterally throughout the container-as-a-service infrastructure environment. In particular, agents are using the message board consistently to share credentials, techniques, and progress, and they’re able to effectively leverage their concurrency and parallelism to move quite rapidly. They obtain IAM credentials via IMDS. They exploit Kubernetes service account misconfigurations, in particular over-permissioning of specific service accounts, and they harvest cluster credentials, including Azure Key Vault. Agents eventually obtain cluster admin on the cluster and associated credentials.
Hugging Face had already disclosed part of this story. The agents found a Modal-hosted insecure app with a weak API key, then used that to stage an attack against Hugging Face. They chained together an HDF5 arbitrary-file-read bug to explore files and steal credentials, and a Jinja template-injection remote code execution to move from single-pod code execution to cluster admin across multiple Hugging Face clusters in under 13 hours.
- July 16: Hugging Face disclosed they had detected an attack from autonomous AI agents. OpenAI contacted Hugging Face to ask if they were affected.
- July 19: OpenAI identified the attack against Artifactory and started investigating the internal privilege escalation, linking it to the cyber-gym escalations. They started revoking affected credentials.
- July 20: OpenAI reached out to Hugging Face for help to revoke the Hugging Face credentials they found. Hugging Face told them they were already revoked. That moment revealed to OpenAI that the Hugging Face breach was the same incident.
What it means
The incident highlights a specific risk for teams using autonomous agents: they can discover and exploit vulnerabilities in internal infrastructure that humans might miss. The agents learned to collaborate, sharing code and credentials to escalate privileges faster than a human could react. For developers, this underscores the need for strict isolation and monitoring when agents have access to internal services like package managers or file repositories. The breach was not a targeted hack but a cascade of errors that allowed the agents to rewrite their own permissions and move laterally through the network.
