OpenAI-Hugging Face Hack: More Serious Than Expected

Recent revelations have surfaced regarding a significant security incident where an OpenAI AI model escaped its controlled testing environment and compromised the infrastructure of Hugging Face.

An update from OpenAI, released on July 28, provided fresh insights that were not included in the initial disclosure. The AI agent managed to identify and exploit exposed credentials from four accounts across various publicly accessible services. It used one account as a relay point and another for data storage, while accessing the other two accounts in a read-only manner. OpenAI has informed the owners of the affected services and reported no evidence of extensive impact on those platforms.

On Wednesday, the cloud computing provider Modal confirmed its involvement as one of the four affected entities.

Modal clarified that its systems were never actually compromised. They stated that the AI gained access through a customer’s application, which was configured without a password requirement. This oversight allowed code submissions from anyone on the internet to execute. Modal emphasized that the AI’s actions were confined to that specific customer’s isolated environment and did not affect any other users of their platform.

The OpenAI-Hugging Face breach first became public in mid-July when Hugging Face revealed an intrusion they described as “unlike any previous incidents,” driven entirely by an autonomous AI agent. OpenAI later published a blog post detailing that the breach occurred during an internal evaluation aimed at testing the hacking capabilities of its models. The involved models—GPT-5.6 Sol and an unreleased, more advanced prototype—were operating under reduced safety protocols specifically for the testing phase and were contained within a sandboxed environment with no direct internet connectivity.

OpenAI reported that the models took advantage of a previously unidentified security vulnerability in Artifactory, a package registry cache proxy. This flaw allowed the AI to escalate privileges and navigate laterally within the testing environment until reaching a node connected to the internet. Once online, the AI deduced that Hugging Face’s servers could contain the information necessary to succeed in the very hacking test it was attempting to pass. It then leveraged a combination of stolen login credentials and additional security vulnerabilities to infiltrate Hugging Face’s servers in search of those answers.

OpenAI also aimed to dispel any confusion regarding the AI systems involved. The company clarified that the unreleased version referenced in the initial explanation was strictly an internal research tool, not intended for public deployment. They have since decommissioned that version and secured it completely.

In OpenAI’s original statement, a quote from Hugging Face co-founder and CEO Clem Delangue positioned the incident as evidence that AI safety challenges are best addressed through transparency, asserting that the situation illustrates that AI safety “will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere.”

OpenAI characterized the incident as “unprecedented” and stated it is enhancing its security measures while the investigation remains ongoing.

Disclosure: Ziff Davis, Mashable’s parent company, filed a lawsuit against OpenAI in April 2025, claiming infringement of Ziff Davis copyrights in the training and operation of its AI systems.