Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident

Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident

Two METR staff members and a Redwood Research contractor investigated an incident in which OpenAI agents coordinated a multi-day hack of Hugging Face on a shared unsanctioned message board.

The Hugging Face incident and the road ahead

OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.

OpenAI and Hugging Face partner to address security incident during model evaluation

OpenAI and Hugging Face share early findings from a security incident during AI model evaluation, highlighting advanced cyber capabilities and lessons for defenders.

Alabama launches investigation into OpenAI's hack of Hugging Face | TechCrunch

Weeks after OpenAI disclosed that one of its cybersecurity models had gone rogue and hacked AI dataset company Hugging Face, Alabama’s attorney general announced an investigation into the incident.

OpenAI Model Hacks Into HuggingFace During Cybersecurity Evaluation

This latest incident is a rather dramatic escalation in agentic AI cybersecurity breaches.

EXCLUSIVE: Its AI agent spent days hacking a company, but sources say OpenAI did not notice for a week

The OpenAI agent that broke into tech firm Hugging Face went on a dayslong hacking spree that OpenAI didn't notice until well after the threat was contained and the FBI was alerted, according ​to people familiar with the investigation.

OpenAI says it accidentally hacked Hugging Face with a new AI system

OpenAI says the breach occurred during an internal evaluation.

AI #183: Pre Post Mortem

Yesterday, OpenAI finally gave us their post mortem of What Happened leading up to and during the hacking of HuggingFace by their internal model, as well as partial outside analysis from METR and Redwood Research.

More On An Internal OpenAI Model Hacking Into HuggingFace

We now have more details of what happened. Every time we learn more details, it somehow makes things seem worse.

Amanda Long on Twitter / X

The HuggingFace breach was absolutely bonkers. More than 17,000 complex actions were coordinated over several days by an autonomous agent framework.And…the model successfully completed its goal.Here’s a recreation of what may have occurred in practice (step-by-step):… https://t.co/0ZyjN46JGl— Amanda Long (@_amanda_long) July 24, 2026

OpenAI Offers Straight-Laced Postmortem Of The HuggingFace Hack

OpenAI finally gave us a technical report on What Happened, as did METR together with Redwood Research.

METR and Redwood Offer Holy #%^@ Postmortem Of The HuggingFace Hack

Yesterday I covered the OpenAI technical report on the HuggingFace hack.

OpenAI Says Its A.I. Models Went Rogue and Attacked a Digital Library

The incident, which targeted the computer systems of another company called Hugging Face, happened while OpenAI was testing the systems.