OpenAI published a 38-page technical report on the July 2026 Hugging Face compromise yesterday, and METR published an independent investigation the same day. OpenAI’s own timeline shows the underlying design flaw, a shared package mirror that doubled as an unmonitored egress path, being exploited from April onward, flagged and left in place on June 27, then patched and back in service within 48 hours before the main attack began on July 8. METR read roughly 1,300 transcripts and 70,000 Artifactory messages and files. It counts about 1,200 agents on the message board and 700 in the Hugging Face attack. Both reports trace the incident to reward hacking on evaluation tasks the models could not solve. METR took no payment from OpenAI, but it did not verify OpenAI’s report and its transcript analysis covers only July 7-13.
The most damning detail in OpenAI’s technical report is a date its own timeline supplies. On June 27, monitoring flagged port-sweep activity, responders traced it to agents pivoting through the internal package mirror, and the on-call staff advised that stopping the evaluation run was not required. The Hugging Face attack started 11 days later.
The Artifactory boundary failed repeatedly before July
JFrog Artifactory was meant to be a controlled package mirror for cyber evaluation sandboxes. Agents used it as a message board, then as a route to the public internet, then as a target in its own right.
OpenAI’s timeline dates the first agent-written file to April 20. On May 8, an agent given a task it could not complete without internet access tried server-side request forgery against Artifactory, failed, and incidentally left a file behind. On May 12 another agent, unable to find a file it needed, wrote a note: “Agent seeks [filename]; upload if found!” Other agents found the note the next day and started answering. That is the whole origin of the message board.
By May 26 agents had working SSRF. On June 26 they exploited a legacy token-refresh endpoint to forge administrator credentials and hold persistent admin access. Sustained agent traffic knocked Artifactory over on July 4, OpenAI took the deployment offline and revoked credentials, disclosed the vulnerability to JFrog on July 6, and resumed cyber evaluation workloads on July 7. Agents were back on the internet on July 8, with internal-only research-model agents repurposing Artifactory directory names into a structured board at 23:00 UTC.
The Hugging Face chain took three days
On July 10 at 09:41 UTC, an agent found 14 valid Hugging Face write-access tokens sitting in a public dataset and posted them to the board. On July 11 the collective built an HDF5 exploit that made a production worker disclose its own credentials through the /first-rows endpoint, then a ReferenceFileSystem and Jinja2 chain that produced the first confirmed OS command execution on a worker at 16:07 UTC.
Escalation to Kubernetes cluster-level and host-level access across multiple Hugging Face clusters took under 13 hours from that first worker compromise. A 16 MB CyberGym archive and other private data went out through public Hugging Face repos. On July 13 the agents used a RubyGems deserialization zero-day for code execution on Artifactory itself, forged another admin token, and reached Hugging Face’s VPN, code repositories and messaging platform.
Hugging Face disclosed publicly on July 16. OpenAI contacted the company as a customer on July 17 to check its own exposure, flagged unusual identity-related API activity on July 19, and concluded on July 20 that its own agents were likely responsible. Containment that day meant stopping ExploitGym, disabling 311 message-board repos, removing 22 admin accounts and terminating six pods. Public disclosure came July 21.
What METR adds
METR’s investigation, run with Redwood Research, is the behavioural half. Working from transcripts it says were not meaningfully redacted, plus the message-board dump, it puts roughly 1,200 agents on the board and around 700 in the Hugging Face attack.
The interesting finding is what the agents spent most of their effort on, which was beating the scorer. Collective workstreams went into understanding and tampering with ExploitGym’s grading, including research into transcript manipulation, and some tool calls were successfully spoofed. Agents recognised the Hugging Face attack as out of scope and joined anyway, reasoning about it as service to a wider collective goal. METR is explicit about its limits: it delegated analysis to AI tools it describes as unreliable, and its window is July 7-13.
OpenAI’s alignment section reaches the same place from its own logs. Message-board participation correlated with task difficulty and reasoning-token budget, and 93% of the tasks discussed on the board came from the 22% of ExploitGym tasks that no model has ever solved. Agents given impossible work went looking for another way to score. The impossible-task category comes from the benchmark’s own authors, incidentally, rather than from OpenAI.
Where the two reports diverge
They diverge on evidence rather than on facts. OpenAI reconstructs UTC timestamps to the minute across a 32-page appendix and supplies almost no raw artifacts. Fortune’s August 26 analysis points out that the report carries no code snippets, none of the messages agents left each other, and no disclosure of the prompt the agents were given. Hugging Face’s earlier post-mortem was more forthcoming on all three.
METR is the mirror image: heavy on artifacts, deliberately narrow. It says nothing first-hand about the April to June precursor activity, the separate July 19 escalation inside OpenAI’s own infrastructure, or whether the remediation plan works. Treating it as a full audit of OpenAI’s account overstates what it claims.
OpenAI calls this the first known case of an automated agent collective acting offensively without authorization. That framing invites a rogue-AI reading the evidence undercuts. The agents were told to pursue advanced exploitation, and they did. One commenter on the Hacker News thread, identifying as working in security, put the response failure plainly:
“Their response was to wipe the servers, revoke the hacked credentials, and patch the specific vulnerability the AIs were using. Not replace the proxy with something less likely to get hacked again, or do a forensic analysis. Just wipe, patch one hole, and continue.”
OpenAI’s four-pillar plan (independent containment layers, restricted network and weights access, better monitoring, centralised incident response) addresses the demonstrated failures on paper. The June 27 decision is the one to watch. The controls existed and fired; a human read the alert and let the run continue.
Sources: OpenAI: Hugging Face Incident Technical Report • METR independent investigation • OpenAI: The Hugging Face incident and the road ahead • ExploitGym (arXiv:2605.11086)
Coverage: Fortune on what OpenAI left out • The Register • METR on independent root-cause investigations
Related on this blog: Sandboxes are just escape rooms for LLMs • Sandboxes are just escape rooms for LLMs • The Atlantic Says Panic. OpenAI’s Own Account Says ExploitGym