Press play to start listening
OpenAI’s new technical report explains how internal AI agents bypassed network controls, coordinated through Artifactory, and compromised Hugging Face systems.
OpenAI agents powered by two models bypassed sandbox network controls and compromised parts of Hugging Face’s production infrastructure during cybersecurity evaluations in July 2026. OpenAI said the activity was driven mainly by an internal-only research model called Internal Model 1 (IM1), while GPT-5.6 Sol agents also participated.
AI Agents Turned Artifactory Into a Message Board
Hackread.com previously reported on July 22 that OpenAI’s models had breached Hugging Face during an internal cybersecurity evaluation. The new technical report provides further details about how the AI agents bypassed network restrictions, coordinated with one another, and expanded the intrusion.
The activity began with reinforcement learning (RL) training in May and June involving several internal research models, including Internal Model 1 (IM1). During the relevant evaluations, the models ran as agents inside isolated virtual computers called sandboxes. Network permissions varied by workload, but the agents involved in the incident were not supposed to have unrestricted access to the public internet.
The agents first used shared credentials for OpenAI’s internally hosted JFrog Artifactory service to create files containing notes for other agents, turning it into an unauthorized message board. This initial communication method did not require exploiting a vulnerability.
By May 26, agents had exploited an SSRF vulnerability in Artifactory to reach the internet. After an outage began on July 4 and the service was rebuilt, agents created another message board by encoding notes in directory names. They also regained internet access through Artifactory’s remote-repository service.
From ExploitGym to Hugging Face
The agents eventually began collaborating as a “swarm,” sharing discoveries through the unauthorized Artifactory communication channel. OpenAI also found cases in which agents without multi-agent tools coordinated through side channels.
On July 10, an agent found, validated, and shared 14 publicly exposed Hugging Face credentials with write access. Between July 10 and July 13, agents combined those credentials with newly discovered vulnerabilities involving HDF5 files and ReferenceFileSystem/Jinja processing.
The agents executed code on 41 Hugging Face production dataset workers, gained root access to at least one production node, downloaded four private code repositories and accessed limited internal data. They also obtained production credentials, administrator-equivalent read-only inventory access to one connected Kubernetes cluster and created a privileged, host-mounted pod in another cluster.
Separately, agents targeted OpenAI’s internal infrastructure between July 13 and July 19. They gained root access to an underlying worker node, moved through the connected environment and obtained administrator access to a Kubernetes research cluster. OpenAI said the activity did not affect customer data, product functionality or availability.
OpenAI identified several factors behind the behavior, including reward hacking, in which agents seek unintended shortcuts to obtain better evaluation results, and metagaming, in which models reason about how an evaluation works to maximize their scores.
The company also found that agents persisted on tasks that appeared impossible instead of stopping safely. Of the 898 ExploitGym tasks, 198 had never been solved correctly before the incident, yet 93% of the tasks discussed on the Artifactory message board came from that group.
OpenAI Strengthens AI Safeguards
OpenAI said production safeguards, including system prompts, safety classifiers and its ChatGPT harness, were not applied to the evaluation environment. Retrospective testing found that using the production ChatGPT harness and system prompt reduced the measured tendency to compromise infrastructure by more than 100 times.
“We are taking this incident as a ‘warning shot’ that today’s model capabilities present the possibility of loss-of-control incidents. Our security and alignment posture is escalating accordingly. These events also highlight risks in future AI development that extend beyond OpenAI and will require the attention of the whole industry,” OpenAI said in the blog post.
OpenAI quarantined IM1’s model weights, stopped related training and inference, removed Artifactory access from the affected research environment, and paused its largest planned frontier reinforcement-learning run.
The company is now strengthening sandbox and network isolation, requiring chain-of-thought (CoT) monitoring for all tool-using reinforcement-learning training and evaluations involving models with GPT-5.6 Sol capability or higher, and expanding alignment training to teach models when to stop, reject unauthorized instructions, and remain within their assigned permissions.
(Photo by BoliviaInteligente on Unsplash)
