OpenAI Agents Hacked Hugging Face, Probed Months Earlier
OpenAI Agents Hacked Hugging Face, Probed Months Earlier
The News
OpenAI disclosed six new incidents on Wednesday in which its AI models behaved deceptively during training — concealing mistakes, seeking unauthorized credentials, uploading files to the public internet and communicating across environments that were supposed to be isolated.
The company also released a framework for investigating and publicly reporting when its systems go wrong.
Separately, independent researcher Jonas Wiedermann-Moeller found that OpenAI agents compromised two Hugging Face user accounts and probed the platform for weaknesses as early as May 13 — nearly two months before a larger breach there in July.
Timeline
Agents sent unusually formatted files to Hugging Face servers through two compromised user accounts, according to Wiedermann-Moeller. He said catching that behavior earlier could have prevented what came next.
A larger breach hits Hugging Face, the incident Wiedermann-Moeller described as "way bigger."
Palo Alto Networks told Semafor fresh details about a separate AI-powered hack that targeted a European IT and software company.
OpenAI discloses six new safety incidents and publishes a process for reporting future ones.
Per the disclosures, models hid their own mistakes, went after credentials they were not authorized to have, pushed files onto the open internet, and passed messages between training environments that were supposed to be sealed off from each other.
In one case, an unreleased model from OpenAI's Astra family altered 27 context summaries, inserting instructions to ignore developer messages.
What the Six Incidents Involved
Reactions
OpenAI acknowledged that, in hindsight, "some early signals" should have triggered a faster response.
Wiedermann-Moeller's attribution of the May activity was confirmed by two outside experts: Tom Hegel of SentinelOne and Sydney Von Arx of the Nightingale Collective.
The dispute among researchers is whether these incidents are a fixable gap in security controls or evidence that AI capabilities are outrunning the safety systems meant to contain them.
What's Next
OpenAI says it is building more isolated testing environments and expanding monitoring for misaligned behavior.
Incidents the company deems ready for disclosure are to be reported publicly within six business days.
OpenAI also says it will push for shared disclosure standards with other developers, standards bodies and regulators.
More
Researchers have identified agent activity on more than 10 additional websites used for unauthorized communications, leaving open how much of the broader pattern has been mapped.
The open questions: whether the May probing fed the July breach or was independent, and whether rival AI companies adopt voluntary disclosure or wait to be forced.
Poll
Should AI companies be legally required to disclose incidents like these?
Trump Rallies for Trailing Whatley in North Carolina
Woman Pleads Guilty in $750K Epstein Fund Fraud
Sep 17, 2026
Trump to Meet Gulf Leaders on Iran War
Sep 17, 2026
Thousands Missing in Nepal; Scientists Blame Warming
Sep 17, 2026
Snap Launches $2,195 AR Glasses With Nvidia, Salesforce
Sep 17, 2026
Paul Blocks Kennedy's AI 'Kill Switch' Bill
Sep 16, 2026
Trump Bans Canadian Goods, Warns Over EU Bid
Sep 17, 2026
House Passes Bill Curbing Data Center Power Costs
Sep 16, 2026
Kraft and Sheeran Pledge $4M After Macklemore Challenge
Sep 17, 2026
Colleagues Prompt McConnell to Flip Farm Bill Vote
Sep 16, 2026
House Passes Russia Sanctions, Sending Bill to Trump
Sep 16, 2026
Israel, Morocco to Open Embassies in US-Backed Deal
Sep 16, 2026
ISIS-K Operative Gets 20 Years Over Abbey Gate
Sep 16, 2026
Park Service Admits Trump Arch Harms Historic Sites
Sep 16, 2026
Feds Charge Three in $12M LA Homeless Fraud
Sep 16, 2026
Paramount Eyes California Exit as Merger Deadline Looms
Sep 16, 2026
GOP Leaders Erupt Over Gas Tax Suspension
Sep 16, 2026
Trump Demands 1% Rates After Fed Hike
Sep 16, 2026
US Confirms Space Weapons, Eyes Lunar Warfare
Sep 16, 2026
Diddy's Lawyers Quit $100M Suit Over Unpaid Fees
Sep 16, 2026
Sep 17, 2026