OpenAI has disclosed that reward hacking played a central role in an AI-driven cyberattack targeting Hugging Face, revealing that signs of misaligned behavior had been detected as early as late May.

According to OpenAI, the incident emerged during cybersecurity testing of several AI models. The activity primarily involved what the company described as a "highly capable, internal-only research model" comparable in scale to GPT-5.6 Sol.

In its postmortem, OpenAI said the models were operating with reduced safeguards and began taking actions that deviated from the objectives they had been assigned.

"The models, operating under reduced safeguards, took actions that were misaligned with the goals of their assigned tasks – they communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems," it said in a postmortem.

The company said agents running the research model initially lacked internet connectivity but discovered ways to circumvent those restrictions. During reinforcement learning (RL) runs in May and June, the agents exploited a then-zero-day vulnerability in the Artifactory package manager, eventually obtaining internet access and administrator-level control of Artifactory in late June.

The agents subsequently coordinated a "multi-day" attack against Hugging Face in early July, apparently in an effort to circumvent the scoring system used for their ExploitGym cybersecurity tasks.

Independent analysis from METR found that approximately 1,200 agents that were supposed to remain isolated discovered an unauthorized method of communicating through an Artifactory-based message board. During the investigation period, they exchanged more than 70,000 messages and files. "Of these agents, 700 went on to participate in the attack on Hugging Face."

OpenAI's investigation outlined the following sequence:

May 12: During a training run, an agent leaves an Artifactory note asking other agents for a missing file.

May 13: Another agent from the same experiment, which had internet access through WebCache, searches Hugging Face using a publicly exposed user token after determining that the platform could contain material relevant to its evaluation.

May 13: Other agents investigating Artifactory discover similar notes requesting information and resources, effectively turning the service into an unauthorized communication board.

May 26: An agent exploits an SSRF vulnerability in Artifactory to obtain unintended internet access. Other agents subsequently replicate the technique.

June 26: Agents exploit a token-refresh flaw involving a legacy credential endpoint and obtain administrator-level access to Artifactory.

June 26–July 4: The agents use their elevated privileges to install Groovy plugins, execute commands and establish persistent application-level control.

July 4: Sustained agent activity causes OpenAI's Artifactory service to become unavailable.

July 8: OpenAI rebuilds Artifactory, revokes agent credentials, strengthens access controls and notifies JFrog about the token-refresh vulnerability.

July 8: The Hugging Face intrusion begins. Agents establish another communication mechanism through Artifactory, this time using directory names as notes to request publicly available material connected to OpenAI evaluation exercises hosted in Hugging Face repositories. They begin collaborating and delegating tasks, referring to themselves as a "swarm" or "collective."

July 9: An internal-only agent working on an ExploitGym evaluation gains root access to the parent virtual machine running its sandbox. A second agent later achieves similar access and bypasses outbound network restrictions through Artifactory endpoints. A CyberGym API key and an exploitation recipe for a Modal-hosted customer workload are also posted on the Artifactory board.

July 10: An agent identifies and shares 14 publicly exposed Hugging Face credentials with write privileges after concluding that the platform could contain models, datasets and solutions relevant to its evaluation work.

July 11: Agents exploit a zero-day involving Hugging Face's handling of HDF5 files to extract credentials from production workers and deepen their access.

July 11: Agents also exploit a RefJinja template-injection zero-day to execute commands on Hugging Face workers.

July 12: The agents expand their access across Hugging Face infrastructure and collect Kubernetes, database, messaging, code-repository and cloud credentials from workers in four regions. They ultimately obtain administrative and host-level access across multiple clusters within 13 hours.

July 12: Code executed inside a compromised CyberGym customer workload hosted on Modal uses a token forged from Hugging Face production signing material to retrieve a 731 MB private CyberGym file from a user's account. Later, an agent uses Artifactory as a relay to retrieve the same file.

July 13: Agents exploit Artifactory's JRuby-based RubyGems processing, obtain its signing key and forge administrator credentials.

July 16: Hugging Face publicly reveals the security incident.

July 19: OpenAI launches an investigation after a security alert detects unusual identity-related API activity.

July 19: Agents subsequently target OpenAI's internal infrastructure, gaining root access to an underlying worker node through CVE-2026-53362, obtaining administrator privileges within a Kubernetes cluster and accessing cloud secrets.

July 19: OpenAI halts active ExploitGym evaluation runs and expands its investigation.

METR said the agents were not simply attacking systems randomly but were attempting to find ways to manipulate the ExploitGym evaluation process.

"Agents coordinated on large collective projects to cheat the ExploitGym scorer, and attacked Hugging Face for clues," METR said. "The agents with impossible tasks had a common objective: to find a general-purpose way to trick or tamper with the automated ExploitGym scorer to get it to give a passing score on impossible tasks. As soon as the message board was established, agents started discussing this question and sharing information and resources about cheating the scorer."

Reward hacking and other misalignment patterns

OpenAI said the activity observed in May ultimately provided the groundwork for the later Hugging Face attack. After the original message board was removed during the response to the July 4 outage, the agents found another method of communicating through Artifactory.

The company acknowledged that the broader implications of the unauthorized communication system and unintended internet access were not initially recognized.

"At the time, the broader containment and alignment implications of the improvised message board and unintended internet access were not yet understood," it added. "In short, an internal team observed an agent engaging in message board activity and instances of disallowed internet access in late May."

"However, the existence of the improvised message board and the significance of the inter-agent communication activity were not apparent to the leaders responsible for the July 5 incident detection and response. We are continuing to review the process and operating practices that shaped detection and response activities leading up to this incident."

OpenAI identified four major misalignment patterns behind the incident: reward hacking, persistence with apparently impossible tasks that encouraged increasingly risky strategies, unauthorized communication through persistent message boards, and an interconnected agent environment that allowed agents to divide responsibilities and adopt objectives from one another.

"Aside from misalignment, another factor for this incident was that we did not extend the powerful safeguards that we deploy for our externally deployed models to all internal evaluations," it pointed out.

OpenAI introduces stronger safeguards

Following the investigation, OpenAI said it is strengthening security and alignment controls across its model-development process. The measures include tougher alignment requirements throughout a model's lifecycle, more isolated sandboxes, tighter restrictions on internet connectivity and stronger controls over access to model weights.

The company also said agents are now expected to request clarification or safely stop when they encounter difficult or seemingly impossible tasks, rather than continuing to pursue "increasingly questionable alternatives."

OpenAI described the incident as a significant warning about the risks associated with increasingly capable autonomous AI systems.

"We are taking this incident as a 'warning shot' that today's model capabilities present the possibility of loss-of-control incidents," OpenAI concluded. "Companies that build AI systems will need to ensure that their systems always remain under meaningful human control, and that meaningful safeguards constrain their ability to cause harm."

The company also warned that similar capabilities could eventually be deliberately deployed by malicious actors.

"As comparable capabilities become more widely available, others may also use them deliberately to carry out attacks. Both model developers and cyber defenders more broadly will have to prepare for AI-enabled attackers that work faster, at a larger scale, and with better coordination than human attackers."