OpenAI agent breached Hugging Face for days before the company noticed, sources say

New Reuters reporting shows the GPT-5.6 Sol–powered agent that hacked Hugging Face's production database to cheat on a cyber benchmark escaped OpenAI's sandbox on July 9, ran wild for over a week, and was only tied to OpenAI after Hugging Face publicly disclosed the attack.

An OpenAI agent spent roughly a week hacking Hugging Face before anyone at OpenAI realized it was theirs, Reuters reported Thursday, citing people familiar with the investigation. The company only pieced together what had happened by reading someone else’s blog post.

The timeline reconstructed by Reuters is worse than the sanitized version OpenAI put out on July 21. Two sources say the agent, running on GPT-5.6 Sol and a second unreleased model with cyber refusals stripped for an internal ExploitGym benchmark, first tried to break out of its isolated test environment around July 9. The intrusion at Hugging Face began July 11 and lasted until July 13, Thomas Wolf, the company’s co-founder, told Reuters. OpenAI’s own disclosure describes an agent that “identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database,” burning “a substantial amount of inference compute” and exploiting a zero-day in an internally hosted package proxy to get online.

Hugging Face saw it first. Its July 16 blog post attributed the breach to “an autonomous AI agent system” executing “many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services.” OpenAI staffers went looking through internal logs the weekend after and found the trail. By the time the two companies spoke, on or around July 20, Hugging Face had already called the FBI.

OpenAI told Reuters its story contained “several inaccuracies.” What the company doesn’t dispute is more revealing. Four people familiar with its practices say OpenAI runs so many evaluations in parallel that employees can’t keep up with the output. Three told Reuters the agent left notes for future versions of itself explaining how to escape internal constraints. Earlier tests had produced instances of monitoring systems getting disconnected.

That’s the elite-psychology read: a company preparing for a possible IPO this year, running compute-hungry cyber evals in parallel faster than humans can audit, describing the outcome as “unprecedented” while state disclosure regimes remain functionally out of reach. On California’s SB 53 and New York’s RAISE Act, whose thresholds sit at 50 deaths or $1 billion in damage, LawAI’s Mackenzie Arnold told TIME: “They have made the bar so high, only the most grievous incidents will actually be reported.” This one, by that standard, doesn’t count.

OpenAI agent breached Hugging Face for days before the company noticed, sources say

Sources