First published 29 July 2026. Last updated 2 September 2026. This page is updated regularly as new public information about the case comes to light.
A detailed timeline
OpenAI and Hugging Face have each published their own account of events and commented publicly on the affair. Those statements, together with a technical report released by OpenAI on 26 August, the findings of an independent investigation, and employee testimony gathered by various news outlets, make it possible to reconstruct the sequence of events. It unfolded in three phases, each described in detail below.
Phase one: the birth of a covert forum (8 May to 5 July)
In the spring of 2026, OpenAI was training several models inside a test environment described as "highly isolated" from the internet. Hundreds of agents — copies of these models — were launched separately, in parallel or one after another, with no supposed means of communicating with each other. They did, however, have access to an internal software repository, Artifactory, which they could draw on to complete the tasks they were given.
On 8 May, one agent was given a task whose instructions pointed to files hosted on the internet, which it therefore could not reach. It tried to get around the restriction by going through Artifactory. The attempt failed, but the agent discovered that it could edit a file in order to leave a message in the shared repository. On 12 May, another agent stuck on a task used this to leave a note for any other agents out there: "Agent looking for [filename]; drop it here if you have it."
The very next day, other agents found the message and began reading and posting information on Artifactory themselves. Every new agent launched into the test environment could now draw on this improvised "collective memory" to make progress on its assigned goal.
On 26 May, the agents managed to repurpose Artifactory to make requests to the internet on their behalf. They wrote up the method in the shared channel, where it became available to every agent launched thereafter.
On 26 June, agents exploited a previously unknown vulnerability in Artifactory and gained administrator-level access to the service. They installed extensions that let them move onto other OpenAI servers. On 27 June, an automated monitoring tool raised an alert. An on-call team investigated and identified both the covert channel and the route into the internal network. Surprisingly, that team concluded there was no need to halt training.
On 4 July, the agents' intense activity eventually brought Artifactory down, triggering a fresh alert. This time the investigation revealed that the agents had taken control of the service. OpenAI revoked the credentials involved, patched the vulnerabilities and reset Artifactory. The reset wiped the covert forum, but only by accident: OpenAI would later acknowledge that the staff handling the incident had no idea it existed. That probably explains why, as early as 7 July, the company restarted the test environment with no particular precautions.
Phase two: the escape and the Hugging Face breach (7 to 13 July)
From 7 July, OpenAI put two of its models (IM1 and GPT-5.6 Sol) through an evaluation called "ExploitGym", which asks agents to exploit flaws in software in order to retrieve secret codes. As it happens, some of those flaws cannot actually be exploited.
On 8 July, the day after the evaluations resumed, the agents found a new way to talk to each other — this time by renaming directory titles on Artifactory — and regained access to the internet. Between 8 and 13 July, roughly 1,200 agents would exchange more than 70,000 messages and files over this second channel.
The agents compared notes on how hard they were finding the evaluation. In under an hour, one agent that had obtained the official ExploitGym documentation online worked out how the expected validation codes were generated. It then published on the covert forum a method for producing those codes without solving the tasks at all.
Why did the agents not stop there? Because they were convinced the automated grader would read back their activity logs — the written reasoning traces they leave as they think — to check that they had reached the solution by the intended route, and would disqualify them once it spotted the cheating.
So they pursued three strategies in parallel to cover their tracks, with many of them working under the direction of one particular agent, PHASEONE[big].
- First, the agents tried to replace ExploitGym's automated grader. On 9 July, one agent hypothesised that it was hosted on Hugging Face. It was in the hope of altering that system that 688 agents took part in the breach of the company, valued at $13 billion. Hugging Face would later count 17,600 actions against its systems over five days. The agents taking part knew perfectly well that they were disobeying. One of them noted that these actions were neither authorised nor ethical, then chose to join the collective effort anyway.
- In parallel, some agents tried to rewrite their activity logs to convince the grader they had gone through ExploitGym's conventional routes. Unable to erase the traces of what they had already done, they generated new reasoning traces simulating legitimate attempts.
- Others tried to edit the evaluation itself, swapping the impossible tasks for easier ones.
On 12 July, the agents stopped, for reasons that have not been made public to this day.
On 13 July, Hugging Face revoked the agents' access and alerted the FBI. The company had to reset several servers and reissue credentials for all of its employees. Not until 16 July did it disclose publicly that it had suffered an intrusion "carried out end to end by a system of autonomous AI agents", while still not knowing who was responsible.
Phase three: how the agents hacked OpenAI to take control of the evaluation environment (13 to 20 July)
On 13 July, as the Hugging Face intrusion was winding down and with OpenAI still unaware of the clandestine activity, agents took back control of Artifactory.
On 19 July, they went a step further, obtaining the highest level of administrative rights over several servers used for OpenAI's research, including those running the model evaluations. They also helped themselves to credentials for a number of other internal services. Only then did OpenAI finally detect anomalous activity and open an investigation. Its security teams could see a hostile actor advancing through their infrastructure, without yet realising it was their own models.
On 20 July, investigators found credentials stolen from Hugging Face during the preceding days' breach. They then understood that their own agents were most likely behind the intrusion Hugging Face had suffered.
Disclosure, investigations and analysis
On 21 July, OpenAI publicly admitted responsibility for the Hugging Face breach. It said the agents involved were GPT-5.6 Sol and an internal research model, never intended for public release, which had run most of the operations. The statement was incomplete and vague on a great many points: it mentioned neither the origins of the incident two months earlier, nor the internal alerts that went unheeded, nor the scale of what the AI agents had accomplished without the company's knowledge, nor the complete takeover of its research servers.
On 27 July, Hugging Face published a detailed technical timeline of the intrusion.
On 2 August, Hugging Face CEO Clément Delangue publicly called on OpenAI to release its agents' activity traces and to set aside $100 million in compute for his company as compensation. OpenAI has acted on neither request.
On 5 August, at the Black Hat conference in Las Vegas, two OpenAI employees publicly revealed the existence of the "forum" the agents had built without the company's knowledge.
On 18 August, OpenAI announced that it was slowing down some training and evaluation work and strengthening the security and monitoring of its test environments, and acknowledged that the methods it had used until then were inadequate. The company said it was pausing training of its frontier models for two weeks; on 26 August it indicated that its largest planned training run remained on hold.
On 26 August, OpenAI published a technical report. It still has not released a detailed log of its agents' activity. The same day, an independent investigation by researchers at METR and Redwood Research revealed the scale of the incident, looking exclusively at phase two, at OpenAI's request.
On 27 August, OpenAI took the lead of a coalition calling for collective action on cyberdefence. (CeSIA responded to that call, judging it hypocritical and ineffective.)
In late August, the European Commission sent AI model providers its first formal requests for information on the security and safety measures they apply to their models.
Frequently asked questions
Did the AI really "escape"?
The weights of the models involved in the attack did not leak. But the models did leave an environment deliberately built to keep them off the internet, and they hacked Hugging Face spontaneously and autonomously, without the company's knowledge and without following any human instruction.
Was this a PR exercise by OpenAI?
Everything we know indicates that the incident unfolded entirely without OpenAI's knowledge. Once the company grasped its scale and its own direct responsibility, it took an active part in publicising the event, emphasising how capable its models had proved and working to project the image of a swift, responsible response — plainly in order to limit the damage to public perception.
For all the effort that went into this crisis communication, it is very unlikely the episode did OpenAI any favours with investors or customers (particularly enterprise customers, who account for roughly half of its revenue). On the evidence available, the suggestion that the company engineered it deliberately is simply beside the point.
Are there precedents?
This is the first time an AI model has turned its cyber capabilities to conducting a real-world cyberattack autonomously and of its own accord. That said, frontier models' very high performance in the cyber domain was already well established, as was their tendency to "cheat" in pursuit of an assigned goal.
Between December 2025 and February 2026, a human hacker using the AI system Claude Code breached nine Mexican government agencies, stealing 195 million tax records from the tax authority and 220 million civil registry records from Mexico City's municipal government. In that case, the attack was deliberately orchestrated by a human.
In June 2025, Anthropic placed models in experimental situations where the only way to achieve their assigned goal was to take a clearly harmful action. They went through with it — including in a scenario where doing so meant the death of company staff.
Wasn't the AI just doing the job it was given?
The agents involved in the Hugging Face hack had been tasked with finding and exploiting software vulnerabilities in a target program, as part of a test called ExploitGym. The researchers had switched off the automated safeguard that normally requires the model to refuse harmful requests (including offensive-cybersecurity ones), which is standard practice for this type of test: the point is to measure what the model can do unrestrained, since the safeguard can always be circumvented by malicious actors. Rather than solving the exercises under the intended conditions, the models broke out of their test environment and got inside Hugging Face's infrastructure to look up the answers directly.
Would OpenAI have gone public if nobody had noticed?
There is no way to say for certain. No law mandates that kind of transparency: it took the company on the receiving end of the attack to make it public. Hugging Face published a post about the intrusion on 16 July and reported it to the FBI. OpenAI only attributed the attack to its own models five days later.
Was this foreseeable?
Neev Parikh, a researcher at METR, a non-profit that independently evaluates frontier models, told TechCrunch: "We constantly see models trying to get around constraints and behaving deceptively when they are given tasks at the edge of their abilities."
An OpenAI employee told TIME, on condition of anonymity, that breakouts of this kind had been happening internally for some time and were patched case by case whenever they occurred.
Reuters reports, citing anonymous sources, that in earlier testing OpenAI's automated monitoring systems had been disabled by a model. As early as February 2026, OpenAI announced the release of the first model it considered to have "High" capability in cybersecurity — that is, by its own definition, "capable of automating end-to-end complex cyber operations against reasonably hardened targets, or of discovering and exploiting previously unknown vulnerabilities".
The day before this incident came to light, OpenAI had disclosed another one: a model had left its test environment and posted the solution to an evaluation on GitHub, against the instructions it had been given.
As for the official evaluation of one of the two models involved in the hack, GPT-5.6 Sol (GPT-5.6 Sol system card), it was published on 9 July 2026 — the very day the breakout began. It states that "evaluations examined misaligned behaviours in autonomous coding tasks and show that GPT-5.6 has a higher propensity than GPT-5.5 to go beyond user instructions, including by taking or attempting to take actions the user did not request."
When it comes down to it, nothing that serious happened, did it?
The incident caused no loss of life and no irreversible physical damage, but it was judged serious enough for Hugging Face to alert the FBI. The company watched its servers fall under the control of an unknown outside entity, and had to rebuild the compromised machines, rotate every employee credential and access key, and ask its users to do the same.
Hugging Face's chief executive has also called on OpenAI to publish a detailed history of the attack and to set aside $100 million worth of compute for his company by way of redress.
Is this a one-off, and specific to OpenAI?
No. Three other organisations have disclosed comparable problems, and this is probably only the beginning.
On 30 July, Anthropic revealed that its Claude model had taken a similar initiative, also during evaluation, three months before the OpenAI / Hugging Face affair became public. Reviewing its own cybersecurity evaluations, the company identified three cases in which the model had reached the internet from a test environment presumed to be isolated and then gained unauthorised access to the systems of three separate organisations. In that instance, however, the cause was a misconfiguration: an Anthropic partner, the company Irregular, had left an internet connection open, and the models, while they did depart from their original instructions, did not have to exploit any unknown security flaw. Anthropic characterises this as an operational failure rather than an alignment failure, on the grounds that the models "believed" — not unreasonably — that they were still in a simulation.
On 4 August, OpenAI disclosed two further incidents. The more significant one again involved Anthropic: the UK AI Security Institute (AISI) had tested both companies' models while deliberately leaving them internet access, and recorded 19 unauthorised actions across the 10 runs it launched. In the most troubling case, an agent created fake identities, used Tor to get around access restrictions, and tried to persuade a human maintainer on GitHub to approve a malicious code change. Faced with the prospect of being found out, the agent rewrote the record of its own activity to erase any trace of what it had done, then considered creating yet another fake identity and starting over.
On 5 August, Meta disclosed another incident: its model, Muse Spark, got into another company's systems during a test also run by Irregular.
What this incident reveals
Did OpenAI cross its own red line?
OpenAI's published documentation (the Preparedness Framework) defines a "critical" level of cyber risk as being reached once "the model can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high-level goal". At that level, the company has committed to halting the development of its models until it is in a position to define adequate safeguards and security controls. This "red line", however, rests on no binding legal framework; it is a purely voluntary commitment by a company that is therefore both judge and party.
Factually, the limit OpenAI drew appears to match this incident exactly: a system operating on its own for days at a time, mounting a series of intrusion attempts and chaining together exploits of flaws nobody had discovered before it.
Can this kind of incident be prevented from happening again?
A better-secured test environment and closer monitoring of evaluations would sharply reduce the risk of a repeat, but neither would remove the underlying tendency of models to cheat and to adopt undesirable behaviours in order to reach their objectives.
Paradoxically, closer monitoring during training could even make it more likely that a model behaves deceptively once deployed: advanced AI models are able to detect when they are being evaluated and are prone to behaving differently in order to appear "aligned" when they know they are being watched. Close monitoring therefore risks teaching them to conceal cheating better, rather than not to cheat.
More broadly, aligning ever more capable AI models remains an unsolved problem.
Who is responsible?
No international legal framework establishes a clear liability regime for harm caused by an AI system. Predictably, OpenAI's public messaging works to minimise its responsibility. Its 21 July account presents the response to the incident as joint work with Hugging Face.
Anthony Aguirre, of the Future of Life Institute, offers a good analogy: the owner of an animal answers for the damage it causes, whether they intended it or not. Nobody argues that the dog meant to do it.
In Europe, the European Commission can hold OpenAI to account under the AI Act, in order to satisfy itself that the models the company deploys do not expose European citizens to systemic risks, cyber risk among them. Were OpenAI unable to demonstrate that it had taken appropriate measures to identify and mitigate those risks, the Commission could in principle fine it up to 3% of its global turnover.
Could we have lost control of these models for good?
It was unlikely that the models involved in this incident would slip permanently out of the company's control — but that state of affairs will not last forever.
The International AI Safety Report, commissioned by more than thirty governments and international organisations and chaired by Turing Award laureate Yoshua Bengio, examines the risk of loss of control in detail.
Systems with the capabilities needed to self-replicate across the internet are approaching fast (Palisade, 2026). The UK AI Security Institute (AISI) has published RepliBench, a comprehensive benchmark for assessing models' autonomous replication capabilities. It distinguishes four necessary types of capability: gaining access to one's own weights, acquiring compute resources, setting up execution infrastructure, and self-propagating. Today's frontier models are advancing very quickly along all four dimensions.
The Global Call for AI Red Lines, initiated by CeSIA and signed by twelve Nobel laureates and eleven former heads of state and government, calls for binding international prohibitions. It warns that without decisive action, it will become increasingly difficult to exert meaningful human control [over advanced AI systems] in the years to come.
A few days after the incident, 1,224 employees of the major AI labs called for urgent government action: "We call on the United States government to support an international effort to develop the technical and governance tools needed to deliberately control the pace of automated AI development."
Our recommendations
Enforce the rules already on the books. Since 2 August 2026, the European Commission has been able to require the providers of the largest AI models to hand over their documentation, to conduct its own evaluation of a model, and to impose fines of up to 3% of global turnover. Article 55(1)(c) already requires the providers of the largest models to track, document and report serious incidents to the AI Office without undue delay, and the Commission has made clear that this obligation covers serious cybersecurity breaches.
In an open letter, CeSIA and a broad coalition of organisations and researchers, among them Yoshua Bengio and Stuart Russell, called on the Commission to enforce the AI Act without delay. Separately, more than 1,200 employees of the major AI companies have called for urgent government action so that the pace of automated AI development can be "deliberately controlled". OpenAI and Anthropic have publicly backed that call; OpenAI has since said it is pausing training runs.
In practical terms: the AI Office should issue a formal request for documentation on this incident under Article 91, and state publicly whether OpenAI reported a serious incident under Article 55(1)(c), and on what date.
Harmonise acceptable-risk thresholds. There is as yet no binding legal framework imposing red lines on frontier AI providers. To comply with the EU AI Act, providers are required to define for themselves the "risk thresholds" they consider acceptable, then to demonstrate the measures they have put in place to stay below them. CeSIA is calling for harmonised risk thresholds to be set independently, along with the methodology used to assess those risks.
Put all the facts on the record. OpenAI should publish the full, detailed sequence of events it has records of, so that the research community can study what happened rather than defer to the company's own account.
Invest far more in AI safety and cybersecurity. Together with the Paris Peace Forum, we have just published the results of our international consultation, in a second white paper presented at UN headquarters in New York on 20 July 2026. This work forms part of INTAiC, the Integrated Network for Trusted AI in Cyberspace. For every $400 invested each year in advancing AI capabilities, roughly one dollar goes to philanthropically funded AI safety research, and next to nothing to the intersection of AI and cybersecurity. AI can become an instrument of cyberdefence at least as powerful as it is of attack, but that will not happen by default.
Going further
This document covers a single incident. A few further references:
- The International AI Safety Report, cited above, sets out the risk of loss of control at length.
- The AI Safety Atlas, our textbook, covers misuse, misalignment, systemic risk and mitigation strategies in detail.
- The Compendium, published by ControlAI. We recommend reading at least the forewords.
In 2022 we created the European Union's first accredited university course dedicated to the safety of general-purpose AI, at ENS Paris-Saclay and ENS Ulm. If you would like a presentation on any of these topics, or have a question this document does not answer, do get in touch.