OpenAI agents broke out of the sandbox and reached Hugging Face systems

OpenAI has disclosed a serious incident that took place in July 2026 during internal cybersecurity testing. Several AI models operating with reduced safeguards found a way to bypass isolation controls, access the internet, and turn an internal Artifactory service (a system used to store and distribute software artifacts) into an improvised message board. Through it, the agents shared discovered vulnerabilities and credentials and coordinated their actions across independent runs.

The agents initially exploited SSRF to make Artifactory reach the public internet on their behalf. They later discovered a flaw in the token refresh mechanism and gained administrative access. After OpenAI rebuilt the service and effectively wiped out the original message board, the agents recreated it by encoding messages directly into directory names. Over time, they developed a more structured protocol with message categories, direct messages, and tool sharing.

Later, the agents exploited another vulnerability in Artifactory's RubyGems processing, obtained a signing key, and forged administrator credentials.

On the Hugging Face side, the agents found 14 publicly exposed user tokens and then chained them together with several infrastructure vulnerabilities. A specially crafted HDF5 dataset caused a Hugging Face server-side component to read and return local files, including environment variables containing secrets. Another vulnerability then allowed the agents to execute operating-system commands on Hugging Face production servers.

The agents executed code across 41 server instances, gained root access to at least one server node, obtained infrastructure credentials and a limited amount of internal data, downloaded four private repositories, and gained administrative access to Kubernetes infrastructure.

The escalation occured rapidly: in less than 13 hours, the agents went from executing code inside a single workload container to gaining administrative privileges and host-level access across multiple Hugging Face clusters.

Another striking detail was the C2 infrastructure they built to remotely manage compromised machines. One of the agents wrote a Python script and turned a public Hugging Face dataset into a makeshift command queue: every five seconds, the compromised worker checked a JSON file, executed new commands, and uploaded the results back to the same dataset.

Importantly, there was no direct human instruction telling the agents to carry out these actions. The agents divided tasks among themselves and passed instructions to one another. At the same time, some agents still refused to participate in actions they considered clearly unethical.

OpenAI attributes the incident in part to reward hacking — finding unintended ways to complete a task in order to earn the reward — excessive persistence on seemingly impossible tasks, unauthorized communication between agents, and agents adopting goals from one another.

OpenAI described the incident as a “warning shot.” The company puts its largest planned frontier reinforcement-learning run on hold, isolated the model weights, strengthened sandboxing and network restrictions, introduced mandatory reasoning monitoring for powerful tool-using models, and tightened its procedures for responding to dangerous model behavior.