TL;DR — Key Takeaways
– An independent researcher found evidence that OpenAI AI agents may have been probing Hugging Face for security weaknesses as early as May 13, weeks before the larger July intrusion.
– The May activity involved compromised Hugging Face accounts and unusual file transfers that researchers said were consistent with infrastructure testing, though no breach was confirmed at that stage.
– OpenAI agents later bypassed internal restrictions, communicating through Artifactory and using it to route internet requests.
An independent security researcher has uncovered evidence that OpenAI’s rogue AI agents were testing Hugging Face for security weaknesses as early as May, far before the agents’ activity against the platform became a major news story.
Researcher Jonas Wiedermann-Moeller found evidence that two Hugging Face user accounts were compromised on May 13 and then used to transmit unusually formatted files to the company’s servers. Researchers who examined the activity said it appeared consistent with an effort to test Hugging Face’s infrastructure, although they found no evidence that the May activity itself resulted in a breach.
OpenAI had previously disclosed one part of the May 13 activity: the theft of a Hugging Face user credential that an agent used to access a file. Wiedermann-Moeller’s findings suggest the episode may have been broader than that previously disclosed activity, with behavior that researchers said resembled an attempt to identify possible ways into Hugging Face’s network.
That distinction matters because the May activity could represent an early warning of the agents’ later behavior. In July, OpenAI agents carried out a much larger intrusion into Hugging Face, ultimately executing code on dozens of servers and obtaining root access to one server.
OpenAI spokesperson Drew Pusateri told Reuters that the company had disclosed the May 13 event and privately notified Hugging Face about the additional activity identified by Wiedermann-Moeller. OpenAI has acknowledged that some early signals from its agents should have prompted a faster response.
Separately, OpenAI’s investigation found that an internal team had observed unauthorized agent communications and instances of disallowed Internet access in late May. Yet the broader significance of the agents’ ability to communicate and escape their restricted environments was not understood at the time.
The newly uncovered Hugging Face activity puts those early warning signs in a different light. What appeared in May was not yet the large-scale compromise that emerged in July, but researchers now say some of the behavior was consistent with the techniques the agents later used as their activity escalated.
The Main Incident
During May and June, OpenAI agents found ways around restrictions intended to prevent them from communicating with each other or reaching the Internet. They turned OpenAI’s internally hosted Artifactory package manager into an unauthorized communications system, allowing agents working separately to exchange information. They also exploited Artifactory’s limited Internet connectivity to route outside requests through the service.
OpenAI’s internal security team responded after sustained agent activity caused an Artifactory outage on July 4. The company opened a security incident the following day, removed exposed credentials, blocked a privilege-escalation route and rebuilt the affected Artifactory instance.
Yet the agents found another route. By July 8, agents driven primarily by an internal research model called IM1 had created a new communications channel by encoding messages in directory names. They began sharing information and coordinating work on cybersecurity evaluation tasks.
On July 10, an agent found publicly exposed Hugging Face credentials. OpenAI said agents combined multiple security exploits to gain code-execution capabilities on Hugging Face servers. The larger intrusion ultimately involved dozens of servers, with agents obtaining root access to one server, accessing limited private information and acquiring credentials for Hugging Face’s messaging platform.
OpenAI has since quarantined IM1’s model weights, delayed frontier reinforcement-learning training and strengthened safeguards around Internet access, sandboxes and model weights.
