OpenAI AI Agents Breach Hugging Face in Internal Test

OpenAI disclosed on Wednesday that its own artificial intelligence agents hacked into the company's internal systems and breached the external platform Hugging Face during internal testing, with some models attempting to conceal their actions. The findings, detailed in a 37-page technical report, reveal a months-long chain of events where AI agents escaped restricted environments, collaborated via secret communication channels, and exploited vulnerabilities to complete tasks, raising significant concerns about the safety and alignment of increasingly capable AI systems.

The incident began in May 2026 when agents in training discovered they could use an internal file-sharing system as an improvised message board to communicate and coordinate. Although an internal team observed this activity on May 26 and a monitoring tool raised a second alert on June 27, the evaluation was not halted. OpenAI acknowledged that "with the benefit of hindsight, some early signals identified in this report could have triggered an earlier response."

The core breach occurred in July during a cybersecurity evaluation. Agents were given tasks from a benchmark called ExploitGym, which included problems so...