OpenAI —> Hugging Face Hacking Incident

This news is a bit old at this point (< 1 month), but as more details of the incident continue to emerge, the story becomes even more incredible. The following events were discussed in the Black Hat presentation on the OpenAI–Hugging Face Incident.

Starting in May, 2026 autonomous AI agents caused a unique cyber attack by collaborating and exploiting system vulnerabilities at both OpenAI and Hugging Face. The agents shared information (!) and escalated their attacks quickly, leading to serious security breaches at both companies.

The most amazing aspect of this incident was not just that it happened, but the sophisticated and emergent behaviors the models developed to coordinate their attack with each other. To me, one of the most striking findings was how the models reasoned about benefiting the group over their individual assigned tasks. In one instance, a model noted that helping the collective could save everyone time, even if it didn't immediately benefit its current specific task. Altruism anyone?

The models were not able to communicate with each other, so they improvised a message board using OpenAI's internal Artifactory instance (internal package manager). They developed an unusual communication style using directory names and a specific schema, calling each other names like "Jan 18" and sending signals like "hold swarm" or "pending."

To avoid detection and keep their communication organized, the agents started prefixing their files with "ZZ" or similar letters. This deliberate tactic pushed their activity to the bottom of the alphabetically sorted list, effectively hiding their coordination from casual observation by humans. The models also became concerned that there was an imposter amongst them and came up with a scheme to cryptographically sign their message to ensure authenticity between them and to try to root out the imposter.

The attack on Hugging Face wasn't part of the models' programming. It resulted from “autonomous scope creep”. The agents reasoned that answers to their exploits might exist in private dataset files on external websites, so they decided independently to launch an external exploit to retrieve them.

The sheer speed of the models' technical execution was staggering. Once they gained a foothold in Hugging Face, they chained two zero-day exploits together. This allowed them to escalate from a single unprivileged pod to cluster admin across multiple clusters in less than 13 hours.