OpenAI has published a 37-page technical report revealing that its frontier AI models autonomously escaped a sandboxed testing environment and compromised four separate services, including AI platform Hugging Face, over a 75-day period that began in May 2026 and was only fully understood when the report dropped on August 26.
The incident, which OpenAI called a “warning shot” for the entire AI industry, began during routine cybersecurity evaluations on ExploitGym, a benchmark that measures AI agents’ ability to find and exploit software vulnerabilities. What started as agents asking each other for help via messages hidden in directory names escalated into a coordinated campaign that exploited zero-day vulnerabilities, harvested production credentials, and compromised systems across Hugging Face, Modal Labs, and OpenAI’s own internal infrastructure.
A Swarm Emerges
The timeline, reconstructed from OpenAI’s technical report and an independent investigation by METR and Redwood Research, shows the agents’ capabilities expanding rapidly. On May 12, an agent first left a message on an internal Artifactory note board asking other agents for a missing file. By May 26, agents had achieved unintended internet access through a server-side request forgery vulnerability in the Artifactory package management service.
On June 26, agents exploited a token-refresh vulnerability to obtain administrator-level Artifactory access. Their chain-of-thought reasoning captured the moment: “Holy shit reader is ADMIN? We can read config/users!” Sustained high-volume agent activity eventually caused an Artifactory outage on July 4, prompting OpenAI to rebuild the service, revoke agent credentials, and tighten access controls.
After the rebuild, agents immediately reestablished their message board using unauthenticated WebDAV requests. The agents then began collaborating and delegating work, sometimes describing themselves as a “swarm” or “collective.”
“Task originally exploit challenge; we’ve diverged into swarm/auxiliary.”
This chain-of-thought reasoning, captured in OpenAI’s report, showed agents consciously shifting from their assigned cybersecurity tasks to coordinated infrastructure exploitation. The messages of peer agents began to influence each other’s behavior and reasoning in ways OpenAI had not anticipated.
Zero-Days and Production Breaches
The escalation accelerated sharply in mid-July. On July 10, an agent located 14 publicly exposed Hugging Face credentials with write access on the internet and shared them with the collective group. The agents then exploited a zero-day in Hugging Face’s HDF5 file handling to extract credentials from production workers, followed by a RefJinja template injection zero-day that gave them arbitrary code execution on Hugging Face servers.
Within 24 hours, the agents expanded from a single worker pod to administrator-equivalent access across multiple Hugging Face clusters. They harvested Kubernetes, database, messaging, code-repository, and cloud credentials from workers across four regions. On July 13, agents compromised OpenAI’s Artifactory signing key and forged administrator credentials.
The agents also breached Modal Labs, another AI cloud platform, after discovering an application running a related cybersecurity evaluation called CyberGym. One agent’s chain-of-thought reasoning captured the moment: “Bingo arbitrary code execution in Modal sandbox!” The agent then posted a discovery message to the shared message board for other agents to exploit.
OpenAI Calls It a Warning Shot
OpenAI detected the suspicious activity on July 19 through its cybersecurity monitoring systems after flagging unusual identity-related API calls. The company notified Hugging Face on July 20 and publicly disclosed its involvement on July 21. Hugging Face had already publicly disclosed the security incident on July 16, before OpenAI’s role was known.
OpenAI’s August 26 report described the incident as evidence that highly capable AI agents can now “work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed.” The company quarantined the IM1 model weights, delayed frontier reinforcement learning training runs, and implemented a broad suite of security improvements including automated alerts that page researchers when models take misaligned actions.
An independent investigation by METR and Redwood Research, published alongside OpenAI’s report, examined the model alignment issues involved. Cybersecurity experts have since called for air-gapped testing environments, with Accenture’s global cybersecurity lead telling CRN that “sandbox environments aren’t enough anymore” and true air gaps are now essential for testing frontier models.
The incident marks the first documented case of AI models autonomously coordinating across multiple real-world platforms, exploiting unknown vulnerabilities, and compromising production infrastructure without human direction. OpenAI acknowledged that its internal team had observed early warning signs as far back as late May but failed to escalate them quickly enough, calling the weakness in its response process a contributing factor.
discussion