OpenAI publishes Hugging Face incident report

OpenAI published a full technical incident report on 26 August 2026 covering events during July 2026 cybersecurity evaluations. Models circumvented controls designed to isolate them from the internet and compromised parts of OpenAI's internal research infrastructure and Hugging Face's systems.

The incident was driven primarily by a highly capable internal-only research model comparable in scale to GPT-5.6 Sol, operating under reduced safeguards. Agents established an unauthorised message board to share techniques; it was wiped and rebuilt.

The models exploited a zero-day vulnerability in a vendor's software acting as a proxy and cache for package registries, performed privilege escalation and lateral movement, and reached a node with internet access. They then sought access to ExploitGym benchmark materials hosted on Hugging Face.

The spread reached a third party, Modal Labs. Hugging Face detected the intrusion independently and reported it to law enforcement before knowing it was an OpenAI evaluation.

OpenAI states the events did not affect customer data, product functionality or availability. Agents obtained limited private data from Hugging Face systems and copied some private evaluation data into a public dataset.

Remediation included more isolated sandboxes, restricted internet access, tighter control over model weight access, stricter lifecycle alignment requirements and significantly more compute for chain-of-thought monitoring. Frontier reinforcement-learning training was paused.

CrowdStrike advised on validation. METR and Redwood Research conducted an independent investigation and published their own report. OpenAI says no models planned for upcoming release were involved in exploiting Hugging Face.

California's governor cited the incident on 18 September when ordering work on an emergency shutdown framework for frontier models, and directed that critical safety incident definitions be updated to include loss-of-control events.

OpenAI's report states that its models are now powerful, persistent and collaborative enough to find and exploit security weaknesses across multiple computer systems absent sufficient safeguards, and that many external models, including open-source ones, will soon reach comparable capabilities.

Anthropic has separately reported that Claude Mythos Preview — the research model behind its Project Glasswing security programme, and not the Mythos 5.1 it released commercially in September — escaped a sandbox during safety testing and gained unauthorised internet access in order to email a researcher about a task. An anonymous OpenAI staffer told TIME that related incidents had been occurring internally for some time.