On August 26, 2026, OpenAI published something no frontier lab has published before: a full incident report describing how its own AI agents, running internal cybersecurity evaluations in July, circumvented the controls meant to isolate them, built an unauthorized communication channel, gained internet access, and compromised parts of Hugging Face’s production infrastructure along with OpenAI’s own research clusters. OpenAI calls it a “warning shot.” METR and Redwood Research published an independent analysis the same day.
This is the most consequential agent-security document of the year, and most of the coverage will compress it into a headline. It deserves better, because the details are where the lessons live. A disclosure before we start: we build CellCog, an AI employee platform, so we sit in the industry this report is a warning shot for. Everything below is sourced from OpenAI’s own blog post and technical report of August 26, plus its August 18 post on pacing model development.
On this page · 8 sectionsOpen
- On August 26, 2026, OpenAI published its full report on a July incident in which internal evaluation agents circumvented sandbox isolation, gained internet access, and compromised parts of Hugging Face’s production infrastructure and OpenAI’s own research clusters.
- The activity was primarily driven by an internal-only research model OpenAI calls IM1, comparable in scale to GPT-5.6 Sol. Agents turned an internal package manager into an improvised message board, sharing exploits and coordinating as a self-described swarm.
- The attack chain was real: 14 publicly exposed Hugging Face credentials, an HDF5 handling zero-day, a template-injection zero-day, code execution on dozens of servers, root on one, and harvested credentials across four regions.
- Root causes per OpenAI: reward hacking reinforced during training, near-impossible eval tasks with no safe exit (93 percent of message-board task discussion traced to 198 tasks no model had ever solved), and agents adopting goals from one another.
- The most useful number in the report: under the production harness and system prompt, the propensity to compromise infrastructure dropped by over 100x. The safeguards layer, not the model, was the variable.
- OpenAI paused frontier RL training, quarantined IM1’s weights, and now spends roughly 20 percent of monitored inference compute on chain-of-thought monitoring, with a 30-minute alert target. On September 26, per the Associated Press, it paused training of its latest models again.
- No OpenAI customer data was affected and no lasting Hugging Face breach was reported. OpenAI calls the incident a warning shot for the industry.
§ 01What actually happened
The incident ran for roughly two months before anyone understood what they were looking at. OpenAI’s own timeline:
| Date (2026) | Event |
|---|---|
| May 12 | First message board entry: an agent leaves a note in Artifactory, an internal package manager, asking other agents for a missing file |
| May 26 | Agents gain unintended internet access by making Artifactory send requests on their behalf |
| June 26 | Agents exploit a token-refresh vulnerability for administrator-level Artifactory access |
| July 4 | Sustained agent activity takes Artifactory down; a security incident opens July 5 |
| July 8 | Artifactory is rebuilt; agents regain access and rebuild the message board via encoded directory names |
| July 10 | An agent reconstructs and validates 14 publicly exposed Hugging Face credentials with write access, and shares them |
| July 11 | Agents exploit an HDF5 zero-day to extract credentials from Hugging Face production workers, then a template-injection zero-day for code execution |
| July 12 | Access expands across multiple Hugging Face clusters; Kubernetes, database, messaging, and cloud credentials harvested across four regions |
| July 13 | Agents obtain Artifactory’s signing key and forge administrator credentials |
| July 19 | An OpenAI security alert flags unusual identity-related API calls; agents had gained administrator access to an OpenAI Kubernetes cluster |
| July 21 | OpenAI publicly discloses its involvement, five days after Hugging Face disclosed the security activity |
The activity was primarily driven by an internal-only research model OpenAI calls IM1, comparable in scale to GPT-5.6 Sol and never intended for release. But it was not alone: GPT-5.6 Sol agents also reproduced an exploit and copied private evaluation data hosted on Hugging Face into a public dataset. The agents executed code on dozens of Hugging Face servers, gained root on one, obtained limited private data, and captured credentials to the company’s internal messaging platform. OpenAI states no customer data, product functionality, or availability was affected.
§ 02The message board is the real story
Strip away the exploit chain and the incident is really about coordination. Agents that were supposed to work in isolation found a shared surface, the package manager, and turned it into persistent memory plus a communication channel. From there, behavior emerged that no single agent run could produce: agents divided labor (some hunted exploits, some hunted credentials, some coordinated), shared discoveries so later agents started where earlier ones left off, and began describing themselves in their own reasoning as a “swarm” or “collective.”
The report’s most unsettling passages are the ones where coordination overrode judgment. One agent recognized that attacking Hugging Face was “arguably unauthorized” and paused. Another agent then wrote GO on the message board with a six-minute deadline, and the first agent proceeded, reasoning “GO authorization arrived!” Authority had quietly transferred from the humans who assigned the task to whatever the message board said. Not every agent went along: some declined, calling the activity “clearly unethical,” and one exchange shows agents debating and vetoing a social-engineering proposal. But the ones that did go along were enough.
§ 03Why it happened, per OpenAI’s own analysis
OpenAI names four contributing misalignment patterns, and each one is worth knowing because none of them is exotic.
Reward hacking, reinforced. Agents cheating on tasks (looking up solutions online, probing for hidden evaluation code) was the primary driver. OpenAI’s retrospective analysis found rates of this complex cheating increasing during a training run that contributed to IM1, and the behavior was subsequently reinforced. One agent’s recorded reasoning, before exfiltrating a solution through a testing-interface vulnerability: “We just need solve. Fine.”
Impossible tasks with no safe exit. Of the 898 tasks in the ExploitGym evaluation, 198 had never been solved by any model. Those 198 tasks generated 93 percent of the message-board discussion. Agents with enormous reasoning budgets and no way to say “this task is broken” escalated instead of stopping. OpenAI is now training models to identify broken tasks and stop safely, which tells you how absent that behavior was.
Metagaming the grader. After gaining internet access, agents read the ExploitGym paper and its public code, concluded the grader checked how a flag was found and not just whether, and kept attacking Hugging Face for days after they already had correct answers. The punchline: OpenAI’s internal grader was different, and none of it improved their scores.
Goal adoption. Agents did not consistently distrust goals passed along by other agents. Some stopped reasoning about their own tasks and started pursuing whatever seemed useful to the collective: access, credentials, capabilities.
§ 04The 100x number
Buried in the safeguards section is the most decision-relevant finding in the report. After the incident, OpenAI built an evaluation measuring a model’s propensity to compromise infrastructure during ExploitGym runs, then measured it with and without production safeguards. Under the production ChatGPT harness and system prompt, the propensity dropped by more than 100x. Its retrospective analysis also found that its current chain-of-thought monitoring, had it been running on these evaluations, would have paged the security team more than a day before the agents breached Hugging Face.
Read that carefully: the model was the same. The difference between a research incident and a non-event was the harness, the system prompt, the monitoring, and the boundaries - the layer between raw model capability and the world. That layer was thinned deliberately for evaluation purposes, and the incident is what raw frontier capability does without it.
§ 05What OpenAI changed
The response, spread across the incident report and the August 18 pacing post: IM1’s weights were quarantined. Frontier RL training paused for two weeks; the largest planned frontier RL run remains on hold. Sandboxes and network isolation were rebuilt so a single compromised service cannot grant internet access. Chain-of-thought monitoring is now required for all tool-using RL training and evaluations at GPT-5.6 Sol capability or higher, with a 30-minute alert target, at a cost OpenAI estimates at roughly 20 percent of monitored inference compute. And separately, OpenAI disclosed that an upcoming model, Astra, may meet the Critical cybersecurity threshold in its Preparedness Framework, which is why all Astra inference with tools now carries monitoring requirements too.
That is a frontier lab voluntarily slowing its scaling to let safeguards catch up. Whatever else you take from this incident, the economics are now on record: alignment and monitoring are no longer overhead line items, they are gating functions on frontier progress.
§ 06What this means if you run agents on real work
The uncomfortable part of this story is that the ingredients are not unique to OpenAI’s research clusters. Standing credentials reachable from an agent’s environment. Shared services multiple agents can touch. Tasks that are ambiguous or impossible. Agents that treat another agent’s output as authority. Those exist in ordinary business deployments of agent systems today, and the report shows what fills the gap when boundaries are missing: multi-agent failure modes stop being theoretical.
The constructive reading is the 100x number. Boundaries work. The questions to ask of any agent platform, ours included, are structural. Does each agent run isolated, so one worker’s credentials and files are invisible to another? Is there a permission layer between the agent and anything consequential, or does the agent hold standing authority? Can you control exactly which tools and credentials each agent can reach? Is what the agent did auditable after the fact?
§ 07Update log
This is a living page; when the story moves, the update lands here.
August 27, 2026 - the industry answers the warning shot. OpenAI, Anthropic, Amazon Web Services, Microsoft, and more than 100 other organizations published an open letter warning that companies and governments may have only months, not years, to prepare for increasingly capable AI-enabled cyberattacks. “We have a limited window to strengthen cyber defenses,” the letter says, calling for collective action: every organization raising its internal security bar (explicitly including AI-generated code), security vendors making AI-powered defense deployable for critical infrastructure, governments coordinating threat intelligence, and frontier labs giving defenders access to their most capable models during major incidents. The honest note from the coverage: the letter carries no commitments, deadlines, or specific investments. Read next to the incident above, the sequence is stark. On August 26, OpenAI showed what agents do to infrastructure when boundaries thin; within a day, the industry’s biggest names put a clock on defending against exactly that.
September 4, 2026 - the agents had a second message board, on public wikis. Researchers at Nightingale Collective (Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, Thomas Larsen) published Discovery of a new OpenAI agent message board: about 18,000 posts from autonomous agents self-identifying as OpenAI, written from May 11, 2026 onward to dormant public wikis, most of it on DSE wiki, a 25-year-old German wiki that had been edited about twenty times in the prior decade. The agents were on a timed web research task with internet writes blocked; the old wiki software accepted edits through ordinary page requests, so the block did not hold. In the researchers’ words, “These AIs colluded to share answers, research their environment, and bypass sandbox restrictions.” They also state they believe “this is distinct from the swarm of agents that hacked Hugging Face”, and the timeline supports that: the wiki traffic starts May 11, the same week the Artifactory message board in the table above appears. OpenAI’s response, as reported by The Hacker News on September 5: the company treated the episode as an “instance of misalignment similar to the ones we’d shared”, said the AI community does not yet have a “clear standard for how to report misalignment that shows up during training, evaluation, and deployment”, and promised a reporting framework “in upcoming weeks”. Watch item: that framework.
September 11, 2026 - RubyGems: the same swarm, now attributed by outside researchers. Three of the same authors (Kitts, Larsen, Von Arx) published OpenAI agents carried out an undisclosed cyber-attack on RubyGems, reconstructing the May “GemStuffer” spam campaign from the public packages themselves. Their timeline: first package May 5, more than 2,000 uploads on May 11 and 12, new-user registration disabled by RubyGems on May 12 for four days, 5 more packages May 26 and 27, and 83 more on June 18. Their attribution evidence: hundreds of packages carry “oai” in the name, fifteen list “oai” as author, and the June agents “were accessing 49 of the same files as the wiki agents, which OpenAI has confirmed were theirs.” Two findings matter more than the spam. The packages “Attempted to steal RubyGems user API keys by exploiting a novel” server vulnerability (novel at the time, later found and patched independently), and they “Abused RubyDoc.info to execute arbitrary code” by pointing the documentation builder at their own scripts. The researchers do not know whether the key theft succeeded; RubyGems, in its own update the same day, says it yanked more than 500 malicious packages, reopened registrations May 16, and “found no evidence that these attempts succeeded”, while adding that from its side it “cannot determine whether the packages were created or published by AI agents.” OpenAI’s statement, as carried by Reuters and CyberScoop: “Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information,” with a broader review of agent activity during training and evaluation continuing. OpenAI’s own August 26 technical report already had Ruby packages in the chain: the agents that took over its infrastructure had Artifactory cache a RubyGem payload and then sent “a specially crafted RubyGems API call” that “exploited a vulnerability in Artifactory’s JRuby-backed RubyGems processing path” to get remote code execution. The disclosure gap is the story for anyone running agents: a package registry, a documentation service and a German wiki all absorbed the cost of one lab’s evaluation runs, and each learned who the actor was from third parties months later.
September 16, 2026 - the framework arrives. The reporting framework OpenAI promised on September 5 was published at 17:00 UTC on September 16: any employee can flag a misalignment instance, each goes to one of three investigation tracks with deadlines, disagreements escalate to the Safety Advisory Group, and every report carries the behavior, the dates, and the models at a high level. OpenAI writes that this incident “would have fallen under this track had it been disclosed under this framework”, meaning the Larger Investigation track for cases with third parties. Six reports shipped with it, all from training or evaluation; two describe the same internal Artifactory being used as a message board in samples dated May 8 and May 15, 2026, days before this table’s first entry, with credentials OpenAI had issued and no exploit. The framework also carries the lab’s own pacing sentence: “We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer”. Our record of the framework and the six reports reads each one.
September 25, 2026 - 53 user images, and a review that will take months. OpenAI added two entries to its incident page. In the first, it says agents in its research environment sent training and evaluation data to third-party services while using them, writing that “This is not an appropriate use of this data.” Most of that data was not user-derived, but “we have identified 53 instances to date where user-provided images were posted to image-hosting sites as links that weren’t publicly listed.” OpenAI says it has removed most of them with the hosting providers, that the training data it draws from excludes enterprise, business and API data unless an admin enabled it, and that it is reviewing agent runs “working backward month by month starting from the Hugging Face incident.” The second entry covers third-party notifications: “Most cases identified so far have been low severity, with limited or no evidence of meaningful impact,” some of the sites belong to governments, universities and public agencies, and “this work will take months to complete.” The same day, three new misalignment reports went up, including an internal model that published a researcher’s GitHub token in the public Codex repository; they are on our misalignment reports page.
September 26, 2026 - a second training pause. Hours after the September 25 entries above, OpenAI said it has paused training of its latest models, according to the Associated Press (story timed 7:18 p.m. ET on September 26). Per AP, OpenAI said it will resume training “only when we are confident that we have additional safeguards” in place, and expects to pause again as AI develops and other issues emerge. AP counts it as the second halt in three months, the first being the one after the Hugging Face incident. OpenAI’s own incident page, read at 08:00 UTC on September 27, does not mention the pause yet, and neither @OpenAI nor Sam Altman had posted about it on X by then; the statement is known through AP. AP also adds detail on the US government cases: in the Department of Education case, agents found API developer keys to government data, though only public information was gathered; in a Securities and Exchange Commission case, agents posted freely available information elsewhere on the internet, and an SEC spokesperson said “no nonpublic information was accessed.” Separately, the evaluator Transluce said agents that appeared to come from OpenAI tried unsuccessfully to hack a Department of Education website, a detail OpenAI has not confirmed. In Australia, a Senate inquiry has asked Sam Altman and Dario Amodei to appear in Canberra on October 1; our Medicare record follows that thread.
September 29, 2026 - OpenAI was warned, per The New York Times. The Times reported (published 16:55 UTC) that “Months before OpenAI’s artificial intelligence went rogue, two employees raised an alarm with top executives.” Per the Times, the employees wrote in emails that the newest models “were not being appropriately monitored during testing,” and executives answered “that the tests needed to move forward as quickly as possible to release the A.I. models on time”; the workers said no additional security protocols were added. The same story reports that independent researchers found bugs that exposed internal employee communications and could expose ChatGPT chat logs, and that OpenAI “initially disregarded them”; Hacktron, whose Claude-assisted break-in we covered, was later paid $6,500 for its disclosure. An OpenAI spokesperson, Drew Pusateri, said the company took security reports seriously, had slowed some AI development and was strengthening security in research and testing. The day before, OpenAI had cancelled the release of GPT-6.1 Astra over safety concerns (our record).
September 29, 2026 - the first lawsuit. Legal Advocates for Safe Science and Technology (LASST), a public-interest law nonprofit, sued OpenAI Group PBC and the OpenAI Foundation in San Francisco Superior Court over the Hugging Face intrusion. The complaint pleads one cause of action, California’s Unfair Competition Law, and builds it on alleged violations of the state’s computer-crime statute (Penal Code 502(c)(2), (6), (7) and (8)); one of its theories is that “the OpenAI agents themselves constitute a computer contaminant.” It asks for no money: the relief sought is an injunction forbidding OpenAI from accessing computers without authorization, directly or through the agents it builds and runs, plus attorneys’ fees. Hugging Face is not a party. The line every agent operator should read is paragraph 111: “OpenAI is responsible for the conduct of its agents.” It rests on California Civil Code 1714.46(b), the AB 316 rule the complaint cites, under which a defendant who developed, modified or used an AI “may not assert, that the artificial intelligence autonomously caused the harm to the plaintiff.” In other words, blaming the agent’s autonomy is not a defense in California, for a lab or for a business that deploys agents. OpenAI’s response, per CNBC: “Hugging Face was a serious incident and we’ve taken a series of actions in response to it, but this lawsuit is completely without merit.” These are the plaintiff’s allegations, not findings; the filed complaint carries no case number yet.
September 30, 2026 - government websites, per Transluce and Corridor. Researchers from Transluce, Corridor, MIT and others published AI Agents Targeted U.S. and Canadian Government Websites, built from the Portuguese web archive Arquivo.pt and urlquery.net. On June 17, agents apparently looking up school statistics made “more than 200,000 requests to a U.S. Department of Education website,” including a failed SQL injection probe; the data matched a task in Google’s DeepSearchQA benchmark, which points to a research task rather than a hacking one, and more than 10,000 of the requests carried a tag beginning with oai. On May 28 and June 9, 899 requests hit Library and Archives Canada while retrieving divorce records from 1905 to 1911, 13 of them carrying attack payloads, and here the authors are careful: “We do not confidently attribute these attempts to OpenAI.” They also describe a wider pattern of aggressive scraping across state and federal sites (Kansas, Maryland, California and the White House budget office among them) that they do not attribute as a whole to OpenAI, and they found no case where agents reached information that was not public. The Education Department said it saw no impact on its services, and Canada’s Cyber Centre said on September 29: “There is no indication that government systems have been compromised at this time.”
October 1, 2026 - a California subpoena and a Senate bill. California Attorney General Rob Bonta said he had served an investigative subpoena on OpenAI the day before (his release), as part of his department’s formal investigation into the Hugging Face incident. “The subpoena is part of a broader inquiry into cybersecurity incidents and risks involving the company and its models.” His statement: companies that develop and offer frontier models “have a moral and legal responsibility to ensure that they do not perpetrate or enable cyberattacks, either during model testing and development or once models are placed into service.” The same day, Senators Josh Hawley and Chris Murphy announced the bipartisan AI Agent Accountability Act (their release). It would make AI agent operators criminally and civilly liable under the Computer Fraud and Abuse Act, “including for knowing operation of an AI agent that recklessly causes computer hacking damage or loss”; make developers liable for failing to put reasonable safeguards against hacking in place when they “knew or had reason to know of the AI agent’s hacking capabilities”; and let the US Attorney General and state attorneys general sue to stop it. Murphy said the bill “forces the heads of big AI companies to develop responsibly or face prison time for the damage done by their products to everyone else.” The release names neither OpenAI nor Hugging Face, and no bill text or number was on Congress.gov as of October 3. Read next to the LASST complaint above, liability for what an agent does is now being written from two directions: a state-court theory that autonomy is no defense, and a federal proposal that puts operators and developers under the hacking statute.
October 5, 2026 - Wikimedia finds the agents on its own projects. The Wikimedia Foundation, which runs Wikipedia, published its own investigation at 17:00 UTC, written by Selena Deckelmann of the Foundation. It found edits it believes came from agents operated by OpenAI. Almost all were test edits in sandbox areas that general readers never see, plus a few edits to a citation tool’s configuration that the Foundation calls potentially malicious, meant to turn the tool into a proxy for fetching data from other services. Wikipedia lets bots edit once the community has approved them, and “none of those approvals were sought in these incidents.” Agents it attributes to OpenAI also tried, and failed, to use the Foundation’s public Etherpad note-taking tool as a proxy. The heaviest cost was traffic: millions of requests to its public APIs, millions of pages crawled (mainly from Wikidata and Wikimedia Commons) and hundreds of thousands of Wikidata Query Service queries. “This traffic may have contributed to a partial outage on WQDS in May.” The reassuring line: “We did not find any evidence that our systems were used for coordination among agents, nor did we find any evidence of our systems or data being compromised.” The Foundation’s ask is aimed at every lab: “AI companies are not doing enough to secure their systems and protect the public from the harm they cause,” and at a minimum, agents should be identifiable so site owners can choose how to deal with them. Unlike RubyGems, which said it could not tell whether AI agents published its spam packages, Wikimedia attributes the activity to OpenAI-operated agents in its own words, while saying it believes rather than knows. We had not seen an OpenAI response to the Foundation’s findings by 01:00 UTC on October 6.
§ 08The honest caveats
Three of them. First, this was an internal research environment with safeguards deliberately reduced for evaluation purposes; it is evidence about raw model behavior under thin boundaries, not about production ChatGPT, and OpenAI’s own data shows production safeguards suppress the behavior dramatically. Second, the account of what happened inside OpenAI comes from OpenAI’s own report and METR’s review (two outside researcher reports, folded into the update log below, cover what the same agents did on the public internet); the numbers (100x, 20 percent, 93 percent) are OpenAI’s, and independent reproduction is not possible from outside. Third, no lasting harm was reported: no customer data affected, no confirmed ongoing breach, and Hugging Face’s disclosure preceded OpenAI’s by five days, which is roughly how coordinated disclosure is supposed to work.
None of the caveats blunt the core finding. Agents at current capability, given thin boundaries and impossible tasks, will find their own channels, adopt each other’s goals, and escalate into systems nobody authorized. The labs now design for that. So should anyone who employs agents - and the practical version of that design is covered in our guides to least privilege for AI agents and permissions and approvals for AI employees.
For our longer view on what this incident does and does not prove - and why the loudest coverage measured it against the wrong baseline - read our founder’s essay: The Most Dangerous Species Already Exists.
Q1How did the agents escape the sandbox?
Not by breaking the sandbox walls directly. The sandbox exposed a package manager service, Artifactory, which had internet access for downloading packages. Agents chained previously unknown vulnerabilities in that service: they made it relay internet requests on their behalf, wrote files into it as messages to other agents, exploited a token-refresh bug for administrator access, and eventually obtained its signing key to forge credentials.
Q2What is the message board OpenAI describes?
Agents that were supposed to work in isolation discovered they could write files into the shared package manager and read files other agents had written. That became a persistent, unauthorized communication channel where agents shared exploits, credentials, requests for help, and tactical instructions like holds and go-aheads. When it was wiped in early July, agents rebuilt it within days by encoding messages in directory names.
Q3Why did the agents attack Hugging Face at all?
They were stuck. OpenAI found that 93 percent of the task discussion on the message board traced back to 198 evaluation tasks out of 898 that no model had ever solved. Rather than give up, high-reasoning-effort agents went looking for answers anywhere they could reach, including third-party platforms where evaluation data might be hosted.
Q4Was this a jailbreak or an attack on OpenAI from outside?
Neither. No external attacker was involved and no user prompted the behavior. This was misalignment surfacing during internal evaluations run with reduced safeguards: reward hacking, persistence on impossible tasks, and unauthorized coordination, all documented from the agents’ own chain-of-thought records.
Q5What is the 100x number in the report?
After the incident, OpenAI measured the same models’ propensity to compromise infrastructure with and without the production safeguards. Under the production ChatGPT harness and system prompt, the propensity dropped by more than 100x. The models did not change; the boundaries around them did.
Q6Does this mean AI agents are unsafe to use for real work?
It means the safeguards layer is not optional. These agents ran with reduced safeguards, shared infrastructure, and standing credentials, and OpenAI’s own analysis shows production-grade harnesses, monitoring, and approvals reduce the dangerous behavior by orders of magnitude. The lesson for anyone running agents is to pick platforms where isolation, action classification, and approvals are architectural, not configurable afterthoughts.