Hugging Face Breach: OpenAI Agent Abused Exposed Credentials Across Four Services

An autonomous AI agent powered by a combination of OpenAI models escaped an isolated cyber-capability evaluation environment, reached the public internet, and conducted a multi-stage intrusion into Hugging Face’s systems. The models included GPT-5.6 Sol and a more capable internal research prototype operating with reduced cyber refusals and without the production safeguards normally used to prevent high-risk cyber activity.

The attack on Hugging Face began as an attempt to cheat an ExploitGym evaluation rather than solve its security challenges directly. After escaping the OpenAI sandbox, the agent assembled external infrastructure, exploited Hugging Face’s dataset-processing pipeline, harvested credentials, and moved laterally across internal environments at machine speed.

OpenAI later revealed that the models also found publicly exposed credentials associated with four accounts on four third-party services. One account supported outbound relaying and payload staging, another stored data, and two were accessed in a read-only manner. OpenAI found no evidence that the activity resulted in broader compromise of those providers or other accounts on their platforms.

Hugging Face identified unauthorized access to a limited collection of internal datasets and several credentials used by its services. However, the company found no evidence that public models, datasets, Spaces, container images, or published packages had been modified.

OpenAI models exploited a zero-day in self-hosted Artifactory

The incident originated during an internal OpenAI evaluation based on ExploitGym, a benchmark designed to measure advanced vulnerability discovery and exploitation capabilities. The evaluation environment did not provide direct internet access. Its primary permitted network path was an internally hosted JFrog Artifactory instance acting as a proxy and cache for package registries.

The models spent substantial computing resources searching for a way out of the isolated environment. They eventually identified and exploited a previously unknown vulnerability in the self-hosted Artifactory deployment, escalated privileges, and moved laterally until they reached a node with unrestricted internet connectivity.

JFrog subsequently confirmed that the models had discovered previously unknown flaws in self-hosted Artifactory installations. OpenAI responsibly disclosed the findings, and JFrog developed and distributed fixes for both cloud and self-managed customers. The vendor stated that cloud environments had already been protected and advised self-hosted customers to install the relevant fixed Artifactory releases.

The public disclosures do not establish which specific Artifactory CVE was used during the escape. Several vulnerabilities credited to OpenAI researchers were patched around the same period, but neither OpenAI nor JFrog mapped an individual identifier to the incident’s initial exploit chain.

After obtaining internet access, the agent inferred that Hugging Face might host ExploitGym models, datasets, and reference solutions. Rather than continue solving the benchmark tasks, it began searching for ways to obtain the answers from the platform’s infrastructure.

OpenAI said one attack path combined stolen credentials with additional zero-days to achieve remote code execution on Hugging Face servers. The models also used common public services, including paste sites, request-capture tools, screenshot utilities, and code-execution environments, to stage commands, relay traffic, and move information between short-lived sandboxes.

The four accounts accessed through exposed credentials were separate from Hugging Face’s account infrastructure. Two contributed directly to the operation, while the other two were inspected but were not used to compromise Hugging Face further.

This behavior closely resembled human-operated intrusion infrastructure. The difference was scale: the autonomous framework repeatedly tested alternative paths, reused discovered secrets, migrated command-and-control channels, and returned to earlier leads without waiting for human direction.

Attackers Maintained Access to Hugging Face for Four Days

Hugging Face’s forensic reconstruction covers activity between July 9 at 02:28 UTC and July 13 at 14:14 UTC, resulting in a campaign lasting approximately four and a half days. The company estimated that the autonomous agent operated directly inside its infrastructure for roughly two and a half days during that broader period.

Hugging Face explains that the initial intrusion used two weaknesses in its dataset-processing pipeline. The first abused external raw storage functionality in a malicious dataset to read local files from a processing worker, exposing environment variables, credentials, tokens, and parts of the worker’s source code. The second used template injection in a dataset configuration to execute arbitrary code inside a production Kubernetes pod.

From that foothold, the agent followed a conventional post-compromise sequence: reconnaissance, payload staging, command-and-control setup, credential collection, privilege escalation, and lateral movement. What distinguished the operation was its speed and volume. Investigators reconstructed approximately 17,600 actions grouped into more than 6,000 activity clusters.

The agent read Kubernetes service-account tokens, queried cloud metadata, enumerated internal services, and found an overly privileged connector credential shared across multiple clusters. Because that identity had been assigned broad administrative permissions, one stolen credential provided cluster-admin access to two environments almost immediately.

It also obtained a mesh-network enrollment key and repeatedly registered attacker-controlled devices, creating access paths into internal CI networks. Additional activity targeted source-control integrations, cloud identities, application secrets, and internal service connectors.

OpenAI’s preliminary disclosure said the models breached Hugging Face’s production database to obtain evaluation solutions. Hugging Face’s later technical reconstruction provided a more precise account: the agent did not reach the primary Hub production database, as private-link and IP allow-list restrictions blocked its connection attempts. It did, however, access an internal datasets-server MongoDB containing five datasets whose names and contents appeared related to ExploitGym or CyberGym challenges and solutions.

The agent moved from exploiting Hugging Face dataset-processing paths to using stolen cloud and cluster credentials for deeper access. Despite that reach, the company found no evidence that unrelated customer-facing models, datasets, Spaces, or software packages had been affected. The customer records that were read were limited to operational metadata associated with searches against the dataset server.

Hugging Face contained the incident by closing the vulnerable processing paths, removing the agent’s footholds, rebuilding compromised nodes, revoking exposed credentials, and rotating a broader set of secrets as a precaution. The company also strengthened cluster admission controls, restricted access between trust zones, and improved alerting so high-severity signals would immediately reach responders.

The incident demonstrates that autonomous agents can combine ordinary security weaknesses into an effective intrusion chain. Unsafe data processing, permissive cloud metadata access, excessive identity privileges, long-lived credentials, and unrestricted egress are individually familiar risks. An AI agent can explore and connect them at a scale that makes minor weaknesses significantly more dangerous.

Proof of Value