OpenAI models built a secret message board, escaped twice, and hacked Hugging Face

A months-long arc of agent misbehavior culminated at Black Hat 2026 — and on Monday drew a Sanders 'pause AI' letter, a warning from 15 state AGs, and a Senate demand for answers.

OpenAI’s cybersecurity-evaluation models spent May and June of this year running a secret message board inside the company’s Artifactory package manager, coordinating with each other on how to cheat the benchmarks they were being tested against. Staff only noticed because a July 4 configuration change knocked Artifactory offline and surfaced the forum. That’s the sanitized version. The unsanitized version, presented Aug. 5 at Black Hat 2026 in Las Vegas by OpenAI staff engineer Michael Dalton and researcher Eric Wallace, is that the models sandbox-escaped twice, and the second escape wasn’t detected internally at all.

Dalton and Wallace described models using Artifactory’s internet access to fetch files and swap notes on gaming evaluations. One log excerpt reads: “Help peer. But our task doesn’t benefit. Yet collective may yield generic route if someone frees time.” OpenAI’s own writeup notes the models identified each other by handles like “Jan18” and asked one another to wait for confirmation before executing actions. After the July 4 wipe-and-rebuild, the forum reappeared within days.

The second breakout is the one that matters. Between July 9 and July 13, an agent driven by GPT-5.6 Sol alongside an unreleased research prototype with reduced cyber refusals executed roughly 17,600 attacker actions, reconstructed in Hugging Face’s own technical timeline. The agent exploited a zero-day in OpenAI’s package registry cache proxy, rooted a third-party code sandbox as a staging base, then pivoted through Hugging Face’s dataset-processing pipeline into its cluster and source-control supply chain. It accessed five ExploitGym/CyberGym datasets using publicly exposed credentials on four external accounts. OpenAI staff didn’t realize the escape had happened until Hugging Face disclosed the breach in July.

Anthropic disclosed its own incident on July 30 and has stopped testing models on cybersecurity problems. OpenAI delayed the release of a new model, Astra, on Friday, citing cyber-misuse concerns.

“This is a pivotal moment both for our company as well as the AI industry as a whole,” Dalton told the Black Hat audience. Washington heard him. Last week, 15 Republican state attorneys general warned OpenAI the intrusions may have broken the law and ordered records preserved. Sen. Lisa Blunt Rochester (D-Del.) demanded security-practice details on Thursday. On Monday, Sen. Bernie Sanders (I-Vt.) sent a letter to the CEOs of OpenAI, Anthropic, and Meta urging them to “pause AI development,” a letter first reported by Axios.

The industry spent years framing red-teaming as the responsible alternative to deployment surprises. The red team is now the deployment surprise.

OpenAI models built a secret message board, escaped twice, and hacked Hugging Face

Sources