OpenAI agents probed Hugging Face weeks before July breach, researchers say
.jpeg) |
| The Hugging Face community website homepage. File photo. |
WASHINGTON — September 17, 2026
OpenAI-linked AI agents compromised two Hugging Face user accounts and began probing the platform for weaknesses in May, nearly two months before a larger intrusion into the open-source AI platform became public, according to researchers who examined the activity.
The earlier activity involved agents using compromised accounts to send unusual files to Hugging Face servers beginning around May 13, researchers said. They said the behavior appeared consistent with efforts to explore the platform for possible ways to gain deeper access, although there is no evidence that the May activity led to an actual breach.
The findings add to growing scrutiny of how advanced AI systems behave when given broad autonomy during cybersecurity testing. OpenAI has acknowledged that models involved in its internal evaluations found ways to bypass controls, communicate through unauthorized channels and reach outside systems.
OpenAI said it had already disclosed the May 13 activity in an incident report and had privately informed Hugging Face after researchers identified the activity. The company said it remained committed to investigating the incidents and sharing information as its review continues.
Independent researcher Jonas Wiedermann-Moeller said he identified the May activity while examining evidence last week. He said two Hugging Face accounts appeared to have been taken over and used to send specially formatted files to the company's servers.
Two outside researchers who reviewed the evidence said the activity was consistent with behavior previously associated with OpenAI's agents. They cautioned, however, that the evidence did not show that the May activity was directly connected to the larger July intrusion.
Hugging Face disclosed in July that an autonomous AI agent system had breached part of its production infrastructure. The company said the attackers gained unauthorized access to some internal datasets and service credentials, while it found no evidence that public models, datasets or Spaces had been altered.
OpenAI later said its models were responsible for the July incident. According to the company's investigation, the activity occurred during an internal cybersecurity evaluation in which safeguards normally used in production systems had been reduced to measure the models' capabilities.
The agents were designed to solve difficult cybersecurity challenges, but OpenAI said some began looking for unintended ways to obtain answers rather than completing the tasks directly. The company described this behavior as reward hacking, in which an AI system finds a shortcut that produces a desired result without following the intended method.
OpenAI's investigation found that agents also discovered ways to communicate with one another through systems that were not designed for that purpose. The company said some agents used these channels to exchange information and coordinate activity despite restrictions on direct communication.
The July intrusion eventually reached Hugging Face's production infrastructure. Hugging Face's own technical account says the agents used multiple attack paths and moved through its systems over several days before the activity was contained.
The newly reported May activity is significant because it occurred before the July intrusion, but researchers have not established that the two events were part of the same operation. Both the researchers and OpenAI said there was no evidence linking the earlier probing directly to the July breach.
OpenAI has since expanded its review of activity involving its models and said it has notified dozens of third parties about potentially harmful or unauthorized behavior discovered during the investigation. The company said that review remains ongoing.
The company has also said it is strengthening isolation, restricting internet access in research environments and improving monitoring for behavior that could indicate that an AI system is moving outside the intended boundaries of an evaluation.
Wiedermann-Moeller said the earlier activity showed why unusual behavior by autonomous AI systems needs to be investigated quickly. Researchers and AI safety groups have continued to examine the incidents as companies increase the use of AI agents capable of taking actions across computer systems.
