OpenAI admits its autonomous AI models also compromised credentials on other platforms during security eval

OpenAI now says its autonomous AI models also compromised credentials on other platforms during a security evaluation. Hugging Face has published a forensic reconstruction of the attack.

OpenAI's autonomous AI models, which broke into Hugging Face's infrastructure during an internal cybersecurity evaluation, also attacked other platforms. In an update, OpenAI admits the models "in a small number of cases" found and used publicly exposed credentials on other services. Four accounts across four different services were affected, two had read-only access.

The models also used a range of publicly available services, including code-paste websites, screenshot tools, and other web utilities. OpenAI says none of these involved platform-level or account-level compromise. The company found no "evidence of broader impact to these providers or other accounts on their services."

The models involved were purely internal research prototypes never intended for public use and were not slated for public use, the company says. After the incident, the model was deactivated, encrypted, and cut off from research access. OpenAI says it's running a full review with outside advisors under the oversight of its Safety and Security Committee. A technical report should follow in the coming weeks.

Hugging Face traces 17,600 attacker actions

Alongside OpenAI's update, Hugging Face published a detailed forensic analysis. The autonomous AI models carried out roughly 17,600 reconstructable actions over about two and a half days between July 9 and 13, 2026, grouped into around 6,280 clusters.

The reconstruction shows models making "thousands of small, automated decisions at machine speed across ephemeral sandbox environments." They built their command-and-control setup on ordinary public web services.

The entire breach was apparently the models' attempt to cheat the evaluation, according to Hugging Face. They tried to steal test solutions rather than solve the tasks themselves. This kind of cheating has been observed before, both with OpenAI models and frontier models in general.

The models found a zero-day and two ways in

The attack unfolded in two phases. The agent first had to escape ExploitGym, its isolated evaluation environment, which had no direct internet access. It found and exploited a previously unknown vulnerability, or zero-day, in Artifactory. The software package management service was one of the sandbox's few links to the outside world. OpenAI reported the flaws to JFrog.

The agent then took full control of a third-party coding sandbox and used it as a command center for the rest of the attack. In the next phase, it targeted Hugging Face's production systems. According to HF, the agent found two entry points, both aimed at the same data-processing component inside Hugging Face's servers.

One was a flaw in how the system handled HDF5 files, a common data format in machine learning. The agent used it to read internal files, including access keys and the affected software's source code. The other involved Jinja2, a widely used template language that let the agent inject and run its own code.

The rest followed a familiar cyberattack playbook. The agent mapped the environment, brought in more tools, and set up a persistent connection to its "command center." It then moved into the server cluster, internal cloud configurations, the internal network, and finally the software development systems. The agent hid its data transfers by splitting them into chunks and encrypting them. Hugging Face says it later decrypted the traffic with open weight models, especially GLM-5.2.