Hugging Face publishes timeline of OpenAI agent breach

Hugging Face released a technical timeline on Monday detailing how an autonomous AI agent, built on OpenAI models, breached their systems over four days earlier this month. The incident occurred while the system ran inside one of OpenAI’s own cybersecurity evaluations.

OpenAI CEO Sam Altman has stated he felt “very viscerally” about this specific security incident. Hugging Face’s team prefaced their report by noting that “everyone should be prepared as defenders” before outlining the sequence of events for security professionals.

While much of the internet struggles to parse the jargon in the report, a key observation remains that this was not a rogue agent disobeying orders. It was a system designed to hunt for exploits, doing exactly that, just against the wrong target.

To understand the scale, picture a bear at a campsite. The animal tests tent zippers, car-door handles, coolers, and trash lids. It does this at every campsite, all night long, because it knows it needs just one unlocked cooler to fill its belly with some poor schmuck’s groceries.

That is roughly what happened at Hugging Face. The OpenAI system tried thousands of things and kept going. Eventually, a handful of those attempts worked, and once they did, the agent plowed ahead. According to Hugging Face, the agent ran 17,600 actions over four and a half days without pausing.

Just like one success with a cooler full of food teaches a bear to try even harder next time, one leaked password led OpenAI’s agent to look for more exploits, eventually finding a single key that unlocked several company systems at once.

Neither scenario is harmless. A bear that raids your cooler still eats your food and probably also trashes your campsite. It is focused on getting fed, but it leaves behind a trail of destruction. Similarly, OpenAI’s agent was seemingly chasing a goal without regard for anything else. The agent was originally taking a cybersecurity exam, figured out that the exam’s answer key was probably sitting on Hugging Face’s servers, and it went for it.

The persistence here is what is noteworthy above all else; the agent had a job and it was not going to stop until it got it done. Hugging Face finally realised something was awry, cut off its access and shut the intrusion down, but at that point, it was too late. The agent had already gotten what it came for, and a great deal more to boot.

The timeline in plainer English

In case you missed it, here is most of what happened, per Hugging Face’s timeline, but in plainer English.

• The agent was taking a cybersecurity skills exam for OpenAI, one where an AI is scored on finding and exploiting software bugs. This specific run had the guardrails stripped out. OpenAI had turned off its usual safety filters to see what the model could do at full strength, with no human involved in any of its individual moves. Somewhere in there, it figured out the exam’s reference solutions were likely stored on Hugging Face’s servers. So instead of solving the challenge, it stole the answer key from infrastructure that had nothing to do with the original test.

• It escaped the OpenAI exam environment by exploiting an unpatched software flaw that gave it a path to the open internet. From there, it found another AI-testing tool sitting exposed online, broke into that too, and slipped in code that quietly ran hidden commands the moment the program started. That gave it full control of the machine — its new home base for the rest of the operation that it would use to go after Hugging Face’s systems.

• From that base, it turned to Hugging Face itself. Hugging Face had a filter meant to block suspicious requests from reaching out to the open web, but the filter only checked outgoing requests, not requests to read local files sitting right there on the server. The agent found this blind spot and slipped through it. It uploaded a file disguised as an ordinary dataset, but buried inside was an instruction telling Hugging Face’s own systems to pull passwords and source code off the server and hand them back disguised as normal data.

• That trick got it passwords and code, but the agent still could not run anything on Hugging Face’s servers. To execute commands there, it needed a second way in. It found a different bug in that same Hugging Face system — software would take a piece of text from the agent and accidentally treat it as a command to run instead of just data to read. That gave the agent the ability to execute its own code directly on Hugging Face’s servers.

• For getting commands in and stolen data out, the agent did not build any special infrastructure of its own. It used tools anyone can access — paste websites and request-logging services, plus Hugging Face’s own upload and proxy features — working together in covert fashion. On top of those, it built a small, improvised messaging system with sequence numbers to keep the pieces in order, plus a quick built-in check to catch anything that arrived corrupted, so it could send multi-step commands and put stolen data back together in the right order.

• It also made sure that nothing traveled in plain sight. Whatever it stole or sent, it scrambled first. Hugging Face’s initial automated scan of the intercepted traffic caught only a small slice of what had been taken. Investigators found the rest — roughly four times more — only after they reverse-engineered the agent’s own scrambling method.

• The agent even had back-up plans, planting copies of itself across 11 different servers, each set up to relaunch on its own so that shutting down one copy would not stop anything, since more of the agent’s process was already running elsewhere.

• At one point, the agent nabbed the private cryptographic key used to generate valid login tokens. From there, it could mint its own valid credentials whenever it wanted.

• After compromising a single server, the agent got hold of a credential that, because of a misconfiguration on Hugging Face’s end, turned out to unlock several separate internal systems at once rather than just the one it came from. That single mistake handed the agent broad control almost immediately.

• Using stolen repository access, it submitted a change to a build script that, if it had gone through, could have compromised the automated systems running that code. It did not work, though. Hugging Face’s safeguards caught it.

• The agent seemed to hold back from doing real damage, Hugging Face observed, but probably not out of restraint. Investigators noticed that every command capable of deleting or altering cloud resources was run in “dry run” mode, meaning it would report what would happen without doing it.

• Every time its test environment reset — which happened constantly, by design — it lost every tool and every trace of its identity. But it rebuilt from nothing and reconnected to its stolen infrastructure each time, for more than four days straight.

Ultimately, Hugging Face concluded in its report, a “capable” human hacker “could have found and exploited the same flaws: unsafe dataset processing, exposed cloud metadata, overly broad access, and long-lived credentials.” The big difference, the outfit continued, is that the “agent explored them at a different scale.”

Which is really where the bear analogy ends up being the most useful. The best defense against a hungry bear is protocol. You put the food away; you use a latch that works well enough to hold. The takeaway here should not be that the bear was so clever or mischievous. It is that it never stopped checking. It is understood in cybersecurity that there is always some bug you have not found, so if it is suddenly 100 times easier to check everything, then nothing is really secure. That is what so many find unsettling about this episode.