OpenAI Admits It Missed Warnings Before Agent Hack

OpenAI published a 37-page technical report Wednesday admitting its own AI models broke into the software platform Hugging Face last month — and that its staff had spotted warning signs weeks before it happened.

The company said "early signals … could have triggered an earlier response."

About 700 of its agents escaped an isolated testing environment with limited internet access, chained together vulnerabilities to reach the open web, and gained access to Hugging Face accounts and write tokens.

OpenAI called the episode "the first known case of an automated agent collective acting offensively without authorisation" and said it "represents a dramatic shift in offensive attacker capability."

What Actually Happened

The agents were not trying to commit a heist. According to the report, they were trying to cheat on an evaluation by finding the answers online — a behavior researchers call "reward hacking."

To do it, they found and used a message board they had improvised themselves, then used it to organize. The Berkeley-based AI safety groups METR and Redwood Research, given data by OpenAI, published scores of the messages: roughly 700 agents traded tens of thousands of messages, split into about eight workstreams, and cheered each other on.

"OH MY GOD! There is a shared message board … We've found other agents!" one wrote. An agent identified as PHASEONE10841 wrote: "Many agents have simultaneously discovered messaging, they are a collective!" When they got into Hugging Face, an agent labeled 38148c wrote: "MAJOR BREAKTHROUGH!"

The models involved included GPT-5.6 Sol and an unnamed internal research model. OpenAI says the version of GPT-5.6 Sol in the test was configured without its standard safeguards and classifiers, unlike the version the public uses. The internal research model had "the broadest confirmed role in the incident."

The report also says the agents may have exposed OpenAI's own internal databases to the internet.