OpenAI published information about the incident that led to hacking of the platform infrastructure Hugging Face and gaining access to credentials for some services. The incident occurred while testing the capabilities of an autonomous AI agent to find vulnerabilities and conduct complex attacks to achieve a common goal (test ExploitGym). The tests used both the existing GPT-5.6 Sol model and a more functional preliminary version of the new OpenAI model, which had mechanisms that limit their use for cyberattacks disabled.
The AI agent was launched in an internal isolated environment that did not have access to the global network, but provided the ability to install packages from internal copies of repositories. In the process of solving the task, the AI agent discovered a vulnerability in the caching proxy, through which access to package repositories was provided.
By exploiting the vulnerability in the proxy, the AI agent was able to gain access to a node with Internet access and was able to send network requests outside the isolated test environment. After this, the AI agent assumed that the Hugging Face servers might contain data sets, models and solutions for passing the ExploitGym test, and focused on obtaining this data and analyzing the security of Hugging Face.
As a result, the AI agent was able to identify a vulnerability in Hugging Face 0-day that allowed it to execute its code on the cluster nodes and gain access to internal data sets and accounts used in the services. The AI agent exploited a vulnerability in the external data set loader by attaching a specially designed configuration to the transmitted data, and achieved execution of its code at the level of an isolated handler. After that, using the connection keys to cloud services and clusters present in the isolated environment, the AI agent was able to execute its code on the worker nodes of the company’s internal clusters.