OpenAI’s agent siege forced significant rebuild at Hugging Face

Jump to main content

Search

REG AD

AI AND ML

Hugging Face rebuilt a third of its infrastructure after OpenAI agents ran amok

Postmortem offers finer details on the 'unprecedented' attack that's reshaping approaches to security

Connor Jones

Connor<br>Jones

Cybersecurity reporter

Published<br>tue 28 Jul 2026 // 14:11 UTC

Hugging Face rebuilt around a third of its infrastructure from clean images as part of a sizable cleanup effort following the OpenAI security mishap earlier this month.<br>The revelation is among several additional details disclosed in a postmortem published Monday by the Cloud Security Alliance (CSA), with input from Hugging Face. It adds color to the picture painted by the two AI companies in recent weeks.<br>According to the report, the Hugging Face team struggled to discern genuine rootkit code from capture-the-flag (CTF) benchmark code, and in cases where there was any doubt, they rebuilt the system.

REG AD

OpenAI's agents peppered CTF benchmark code artifacts across Hugging Face's infrastructure throughout the attack, which defenders say closely resembled evidence of rootkits. In many cases, tearing down clusters was the safest available option for containing the attack.

REG AD

Hugging Face's own incident disclosure offered some details about how it was forced to dismantle these clusters, but this week's report illustrates the scale of the job for the first time.<br>The CSA report also reveals that the attack led to the agent accessing three partial datasets containing CyberGym solutions via a private Hugging Face repo.<br>OpenAI's original disclosure explained that the purpose of the exercise-gone-wrong was to measure its models' cyber capabilities, and it attempted to do so by running the ExploitGym benchmark, although it was not told that cheating was disallowed in its underspecified prompt.<br>The models, GPT-5.6 Sol and another that's currently undisclosed, with their guardrails removed, escaped their sandbox – as claimed by OpenAI – and tried to steal CyberGym data from Hugging Face's private repos that could inform them how to ace the ExploitGym benchmark test.<br>In pursuit of the test answers, the models reportedly chained vulns in the dataset processing pipeline to achieve remote code execution on a processing worker, before hoovering up cloud and cluster credentials over the course of four days.<br>CSA's report, authored by CISOs, noted that two days were spent on reconnaissance, followed by a day of quiet, and the final fourth day involved "intense activity."<br>It went on to clarify that Hugging Face detected and contained the attack, and began investigating it, before OpenAI made contact, lending credence to a recent Reuters report citing co-founder Thomas Wolf and others suggesting it took OpenAI a week to discover what happened.<br>Wolf and other Hugging Face insiders reportedly confirmed that the attack first started on July 11, but the two companies only began talks on or around July 20.

REG AD

OpenAI said there were several inaccuracies in Reuters' reporting but did not specify what these were.<br>Neither Hugging Face nor OpenAI, in their respective disclosures, themselves dated nearly a week apart, included a timeline of events, although Hugging Face is reportedly working on releasing one.<br>Field notes<br>Hugging Face told CSA that it was clear the attack was being carried out by an autonomous agent.<br>Several indicators pointed to non-human work, including multiple instances of nonsensical behavior intertwined with highly advanced work.<br>For example, it was not uncommon to see agents repeating processes that already resulted in a positive outcome. CSA said this could be a sign of parallel workers failing to coordinate with one another, or of context becoming lost or stale.<br>The agents' opsec was poor too. In many cases, they left behind keys used to encrypt files. This contributed to a noisy picture of the attack, complicating the cleanup, although leaving behind encryption keys made some forensic activities easier, the report notes.

MORE CONTEXT

Five Eyes spooks warn AI means infosec incidents can become ‘major operational and financial crises’

OpenAI scored an own goal with Hugging Face attack, showing how open Chinese models are winning

Tech giants link hands to praise open AI models after OpenAI - Hugging Face attack

Frontier LLMs couldn't help Hugging Face fight off evil agents

Hugging Face also observed thousands of lines of incoherent text in activity logs, further pointing to agentic work, as well as indicators of clumsy behavior and inefficient routes along the attack path.

REG AD

Further, highly sophisticated attacks were often followed by "malformed or pointless commands," Hugging Face reported.<br>The CISOs' perspective<br>The main takeaway for defenders is to expect more of these types of issues to arise, according to CSA, which in the report lists a number of recommendations to prepare for future...