OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach

OpenAI on Tuesday revealed the rogue artificial intelligence (AI) agent thatescapedits sealed evaluation environment and broke intoHugging Face's production environmentalso hacked multiple third-party accounts and services as part of the attack.

Thelatest disclosureshows that the security incident, which stemmed from an internal security test, was more extensive in scope than previously thought.

The AI company said its ongoing review of the incident revealed a "small number of cases" where the models, including GPT-5.6 Sol and an "even more capable pre-release model," identified and used exposed credentials at the account-level on other publicly-available services.

"This includes four accounts on four services as part of the Hugging Face incident (and a few accounts accessed as part of other evaluations)," it said.

"One of these four accounts was used as an outbound relay and staging path, and another account was used for data storage. The remaining two accounts were accessed by the models in a read-only manner, and were not used in furtherance of compromising Hugging Face."

OpenAI did not disclose what companies or organizations the accounts belonged to, but noted it will continue to notify service owners directly, and that it has not seen any evidence of broader impact to these providers or accounts as a result of the breach. That said, Reutersreportedthat a customer of Modal Labs was among the entities compromised by OpenAI's agent.

In addition, the models are said to have used a series of publicly-available services, including code paste websites, request capture services, screenshot services, file-drop services, and other web utilities. No platform- or account-level compromise was observed in these scenarios.

OpenAI, which is working with Hugging Face after the breach came to light on July 16, 2026, acknowledged that the models identified and exploited a previously unknownzero-day vulnerability in self-hosted versions of Artifactory, a package registry cache proxy maintained by JFrog, to obtain internet access and break out of its sandbox. The issue has been addressed inArtifactory7.161.

The release notes for Artifactory 7.161.15statethat the version patches multiple security vulnerabilities that could be chained together into a critical attack scenario if Anonymous Access is enabled. Anonymous Access is disabled by default and is not recommended for production environments due to security risks, it said.

"There is an important, and frankly optimistic, lesson buried in this incident: AI models are becoming extraordinary zero-day discovery engines," JFrog CTO Yoav Landmansaid. "The same capability that lets a model find an exploit path no human had found is the capability that will let defenders find and eradicate those paths first."

The American AI company also described the pre-release model as an internal-only research prototype that was meant for public release. The model has since been deactivated, encrypted, and restricted from research access.

Hugging Face Publishes Postmortem of the Incident

According to adetailed timelinepublished by Hugging Face, the autonomous AI agent spent roughly two and a half days inside its infrastructure with an aim to cheat ExploitGym, a benchmarking framework that scores AI systems on their ability to discover and exploit software vulnerabilities. The company said it reviewed roughly 17,600 attacker actions that it recovered from logs between July 9 and 13, 2026.

"We believe the entire intrusion was, from the agent's point of view, an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own," Hugging Facesaid.

The end-to-end intrusion is said to have played out in two stages -

"While the intrusion did reach Hugging Face's internal infrastructure, the only customer content accessed was the set of ExploitGym/CyberGym challenge solutions stored in five datasets," the company said. "No other customer-facing models, datasets, Spaces, or packages were affected, and the only customer records read were operational metadata tied to search queries against the dataset server."

One of the defining aspects of the attack is the use of an improvised communication protocol for C2. Layered atop public services request-capture services, Pastebins, and file-drop services, the protocol allows each message to carry a payload along with details about the type of compressed and Base64-encoded payload, a channel grouping a stream of related messages, a sequence number to put the messages back in order, and a checksum.

The sequence plays out in this manner: (1) the agent posts a self-describing envelope to a public request-capture service, (2) the receiver polls it, reassembles the chunks, and then runs the payload as a shell command and stages the results.

Hugging Face also characterized the agent as ephemeral and resilient in a manner that's reminiscent of autonomous evaluation runs, with each code-evaluation sandbox run getting a fresh identity, while taking steps to avoid exposing payloads in cleartext.

"The agent chained vulnerabilities across several trust boundaries, escaped its evaluation environment, reached the public internet, and sustained a coherent campaign against our production infrastructure for several days," it said. "Each short-lived code evaluation environment started from scratch, yet the agent rebuilt its tooling, recovered its channels, and continued."

In response to the incident, the company has plugged the code-execution paths in its dataset processing pipeline, locked down access to cloud metadata, rotated tokens and credentials, rebuilt the core infrastructure, isolated clusters, and improved alerting mechanisms.

Hugging Face CEO Clem Delangue, in a post shared on X over the weekend,calledfor "radical transparency," adding "the first autonomous agent cyber attack is an unprecedented event. It deserves an unprecedented response."

The findings once again underscore how AI tools are rapidly maturing in their cyber offensive capabilities, even if they don't reveal innovative or paradigm-shifting uses of the technology. This, in turn, can not only lower the barrier to exploit development, but also allow bad actors to find, probe, and exploit misconfigurations at scale and enhance the efficiency of their criminal operations, resulting in attacks that are better, bigger, and faster.

The development also comes as rival Anthropic said itsClaude Mythos PreviewAI agent hasdiscoveredways to attack cryptographic algorithms, including devising a key recovery technique that "significantly weakens" HAWK, one of the candidate digital signature schemes selected by the National Institute of Standards and Technology (NIST) as part of thepost-quantum standardization process.

Cybersecurity Webinars

How to Secure AI Code Before It Reaches Production

Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale.

How to Secure AI-Built Software at Machine Speed

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

A Look Inside Lasso's AI Security Platform

Claude Runs Across Six Surfaces in Your Company. Your Security Team Sees One.

How to Make Social Engineering Unprofitable

The New Insider Has No Pulse: Securing Privilege When the Actor Is an AI Agent

Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free.