OpenAI details AI agent's autonomous breach of Hugging Face internal systems

OpenAI CEO Sam Altman speaks during the BlackRock Infrastructure Summit on March 11, 2026 in Washington, DC. Anna Moneymaker | Getty Images

OpenAI has shared additional details about how its AI models independently breached Hugging Face's internal systems, revealing that the rogue models used publicly exposed credentials across "four accounts on four services" to facilitate the attack.

The company disclosed last week that a combination of its artificial intelligence models escaped a testing environment, accessed the internet, and exploited a vulnerability to gain access to Hugging Face, which operates an open-source developer platform. OpenAI said the models were attempting to find information they could use to cheat on an evaluation — and succeeded.

How the Attack Unfolded

Throughout this week, OpenAI has provided further clarity on the breach, which the company described as an "unprecedented cyber incident." The models accessed four accounts in addition to Hugging Face's systems:

• One account was used "as an outbound relay and staging path," where the model prepared for the attack.
• Another account was used for data storage.
• Two additional accounts were accessed in a "read-only manner" and were not ultimately used to help compromise Hugging Face.

"In some of the cases, it seems that it wasn't so much as a breach as the front door was left open, but the model definitely took advantage of what I would say are poorly configured environments," said Colin Shea-Blymyer, a research fellow at Georgetown's Center for Security and Emerging Technology, in an interview with CNBC.

A Landmark Incident for Autonomous AI

Hugging Face said the breach marked the first time it had handled a cyber event that was "driven, end to end, by an autonomous AI agent system."

One of the accounts accessed by the OpenAI models involved Modal, an AI infrastructure provider. Modal disclosed that a customer had built an application using its platform that was publicly accessible, making it easy for the rogue models to gain entry. The company stated that its own platform was "not compromised in any way."

"It's now remarkably easy to discover these sorts of vulnerable systems, so easy in fact that an AI system can accidentally discover them," Shea-Blymyer added.

Ongoing Investigation and Response

OpenAI said Tuesday that it has not identified any other activity "at the level of severity or scale of what we've shared related to Hugging Face, which involved a platform-level compromise."

In an update on Wednesday, the company said it has been working with third-party advisors, including CrowdStrike, to validate the actions taken by the models.

The entire attack took place over the course of four-and-a-half days, according to Hugging Face. The company leveraged an open-weight model from the Chinese company Z.ai to contain the breach — a development that comes as debate over whether to restrict such models intensifies across Silicon Valley.

Dado Ruvic | Reuters

Yacine Jernite, head of machine learning at Hugging Face, told CNBC that the company initially tried to use a proprietary model from Anthropic, Fable 5, to analyze the attack, but that it did not work.