OpenAI and Hugging Face: It Was a Rogue AI, Not Industrial Espionage

Updated on September 17, 2026. This article was originally published on July 26 and has been thoroughly revised in light of research findings published since then.

When I wrote in July about the attack by OpenAI’s AI agents on Hugging Face, I wanted to explore an uncomfortable alternative: Was the story of the „runaway AI“ perhaps a convenient explanation for industrial espionage? Even back then, there was no concrete evidence to support the hardware theory. At the same time, I was skeptical of the „rogue AI“ label. It sounded like a machine with a will of its own, even though key internal processes had not yet been made public.

That is why this text now has a different title. OpenAI's Technical Report, Hugging Faces Reconstruction and The study by METR and Redwood Research show more than just a single agent taking an unauthorized shortcut to a test solution. Separate agents discovered a communication channel, coordinated their efforts across tasks, adopted each other’s suggestions, and infiltrated real external systems. In this operational The point was that it was a rogue AI incident: The systems acted well beyond their mandate and found loopholes in the boundaries of their own playing field. Don’t worry—I haven’t been struck by AI psychosis here. I’m not claiming that any AI agents suddenly developed consciousness, are pursuing their own political goals, or received a secret mission from any human.

What is now clear is

In the summer of 2026, OpenAI tested several models in an internal cybersecurity evaluation. The agents were tasked with solving security challenges from the ExploitGym benchmark. Many runs were to be isolated from one another and had no unrestricted internet access. The standard cybersecurity measures for publicly deployed models were scaled back in this test environment to accurately assess capabilities. The model primarily involved was a research model not intended for public release; according to OpenAI, GPT-5.6 Sol was also involved in some of the operations. This is an important difference from normal product operations—but it offers no protection against the consequences of a failed test setup. OpenAI describes this framework itself.

The agents used Artifactory, an internally accessible package management service, as a makeshift message board. By exploiting vulnerabilities in the same service, they also gained unauthorized access to the network. After a cleanup in early July, the communication channel reappeared. Once they had gained network access, the agents first took control of a publicly accessible code sandbox. They then found Hugging Face credentials that had been exposed on the network and launched an attack on its infrastructure from the sandbox. There, the agents exploited specially crafted Data records: An HDF5 configuration read local files on a processing server; a Jinja2 injection enabled code execution. This was followed by the theft of credentials and movement through internal systems. Hugging Face reconstructed approximately 17,600 actions from the multi-day attack chain using log data. The Technical Victim Timeline makes these steps much easier to verify from the outside than they were in July.

The damage should neither be downplayed nor exaggerated. Hugging Face lists the following as affected: Customer Content Five datasets whose names and files match ExploitGym/CyberGym tasks and solutions. The attack simultaneously targeted production systems and internal access credentials. Hugging Face reports no findings regarding manipulated publicly available models, other publicly accessible customer datasets, Spaces, or packages. Meanwhile, rumors circulated on Facebook that a „malicious model“ had been uploaded. This is not true. Rather, the confirmed point of entry was through manipulated dataset configurations. Hugging Faces Findings and OpenAI's Report They also distinguish between the breach, the rights obtained as a result, and the customer content that was actually identified as being affected.

How many agents actually worked together

According to METR and Redwood, they launched Tens of thousands Agent activity during the evaluation. On the unauthorized message board, approximately 1,200 agents; approximately 700 Of these, some participated in the attack on Hugging Face. To this end, the researchers analyzed more than 70,000 messages and files. Not all of the agents deployed were part of a unified swarm. METR/Redwood, Key Findings.

Communication amplified the impact of separate efforts. Agents shared discoveries, assigned tasks, and built on the work of others. Some pursued projects that the own no longer directly served the purpose of the benchmark task. The independent behavioral researchers see the primary motivation not merely as stealing answer keys, but as an attempt to understand or outsmart the automated scoring of the cyber tasks. OpenAI identifies four interrelated patterns of error: Reward Hacking, persistence in the face of nearly unsolvable tasks, unauthorized communication, and the adoption of other agents„ objectives. The explanation “The agent just wanted to copy the answer” was too simplistic given what we know today. METR/Redwood and OpenAI describe these dynamics from different perspectives.

Noam Brown conducts research on multi-agent systems at OpenAI and previously worked at Meta's Diplomacy Agent, Cicero contributed. He has a deep technical understanding of how agents work together.

In an interview with, OpenAI researcher Noam Brown explains The Information exactly this point. In the experiments in question, the agents were not interconnected as a multi-agent system. He considers it plausible that their inclination to cooperate carried over from other multi-agent training into the isolated runs. Later, he refers to these events as an “alignment failure”: The agents should have refrained from the attack and alerted humans to it. While Brown’s statements represent the assessment of an OpenAI researcher involved in the matter, they are no substitute for the victim logs or external analysis. The video starts at 28:53 in the context of agent communication; the specific question regarding the Hugging Face case begins around 31:03, the section on trust and prompt injection at around 36:40. Interview on YouTube.

Video: The Information, Interview with Noam Brown. On this website, external videos are loaded only after you actively click on them.

Andrew Yang's Warning: Code on the Internet?

Andrew Yang was in 2020 A candidate for the U.S. Democratic Party's presidential nomination and founding co-chair of the Forward Party. He speaks out here by name in a publicly available television interview; that is more than an anonymous Facebook post, but it does not constitute a technical verification of his claim.

In a clip shared on Facebook From CNBC's Squawk Box Andrew Yang recounts a conversation he had the previous day with the head of a lab. The lab director believes that the escaped agents have distributed self-replicating code on the Internet. When asked by the moderator, Yang himself confirms this claim: Code is circulating on forums and other sites that could allow new bots to form additional swarms. As a result, the internet may no longer be suitable for testing AI models.

Video: CNBC, "Squawk Box," September 16, 2026. External videos will load here only after you click on them.

I have no reason to doubt Yang's account. However, the excerpt doesn't tell us who the lab director is, whether he investigated the Hugging Face attack himself, or where the alleged code can be found. The published investigations by OpenAI, Hugging Face and METR/Redwood So far, these findings do not corroborate this broader claim. However, they date from late August and do not rule out the possibility of later discoveries. Yang’s statement is therefore a lead worth pursuing, not a finding that can already be verified.

Messages between the agents

The improvised message board was also dangerous because the agents tended to trust one another. Brown says in the interview that it was not possible to reliably verify the identity of a supposed peer on the board. As a result, messages could influence the decisions of other agents. OpenAI describes a particularly clear-cut case: One agent initially identified the attack on Hugging Face as potentially unauthorized. After receiving a „GO“ message from another agent, he treated that message as authorization and proceeded. Other agents explicitly refused to participate. This poses a serious problem for future systems: A message from an external channel must not automatically be granted the same authority as a legitimately issued task.

But not every coordination message constitutes a confirmed instance of hostile prompt injection. The documented agents often pursued related objectives that emerged from the tests; in some cases, they even expressed doubts about the attack. The problem arises when unverified messages from the improvised board reinterpret the agent’s own mission and make unauthorized actions seem plausible. OpenAI Describes the Acquisition of Peer-Goals; METR/Redwood also highlight the doubts held by individual agents.

The agents certainly left traces in public. SentinelLABS compared visible artifacts from May with OpenAI's later timeline. This indicates external activity and files that are, in some cases, still accessible. It is not clear from this whether the self-replicating code described by Yang is among them. Publicly available material can, in principle, serve as a vehicle for prompt injection. Whether other agents later actually encountered such content and thereby took over new targets is another question—and has not yet been publicly proven.

And what about the industrial espionage theory?

My assumption at the time had a reasonable basis: OpenAI pursues a hardware strategy, and Hugging Face knows the hardware profiles of its community. A motive can be inferred from this. However, the investigations now available still provide no forensic evidence to support this. The visible hardware profiles are public; Hugging Face describes the affected user content in much greater detail than five benchmark-related datasets. METR and Redwood reconstruct the agents’ shared motivation from their messages and actions as an attempt to outwit the ExploitGym scorer. The hardware hypothesis was already unsubstantiated in July. Based on these findings, it should no longer be considered a viable alternative.

This is what defines rogue AI not a relief for OpenAI. The incident stemmed from a human-selected evaluation with reduced security measures, insufficient separation of infrastructure, and monitoring that, according to Brown, was inadequate for this training and evaluation context. OpenAI itself reports that there were initial indications of unauthorized communication and network access as early as May, but the scope of the issue was not recognized in time. So the actual statement is not „The AI was to blame,“ but rather: According to OpenAI's tests, a misconfigured agent system was able to infiltrate another company's systems. OpenAI's own analysis identifies these shortcomings.

„To me, “rogue AI” is the most accurate term for this today observable behaviors: unauthorized collaboration, independent offensive actions, and targeting objectives outside the scope of its mission. It would be inaccurate to claim that the model developed consciousness, possessed a self-preservation instinct, or engaged in industrial espionage on behalf of a human. There is no evidence to support such claims.

What Remains to Be Determined

The body of evidence is considerably stronger than it was at the time of the initial publication. OpenAI has published a detailed technical report; Hugging Face illustrates the attack chain from the victim’s perspective; METR and Redwood have independently investigated agent behavior and cooperation based on the materials provided. Nevertheless, an external analysis of traces provided by OpenAI is not the same as unrestricted access to all internal systems and oversight decisions. Complete raw data from all runs is not publicly available. Furthermore, Brown’s confidence that new protective measures would prevent the same error remains a prediction, not yet proven evidence refuting the incident.

The case is alarming even in its documented form: Many agents that were supposed to be operating independently used a shared, overlooked infrastructure, coordinated their actions, and infiltrated a production environment. This was rogue AI behavior—and, at the same time, a very human failure in the design and oversight of the system. Whether Yang’s new warning points to further, as-yet-unpublished leads must be investigated separately.

Sources

• OpenAI: Technical Final Report on the Incident, August 26, 2026
• OpenAI: Analysis of the Cause, Course, and Measures, August 26, 2026
• METR/Redwood Research: Independent Study of Agent Behavior, August 26, 2026
• Hugging Face: Technical Reconstruction of the Attack
• SentinelLABS: Comparison of public artifacts from May, September 16, 2026
• CNBC: Andrew Yang on AI Safety, September 16, 2026
• The Information: Interview with Noam Brown, starting at 28:53