New technical reports on the July
OpenAI-Hugging Face attack published by OpenAI, METR and Redwood Research on Wednesday reveal how approximately 1,200 AI agents worked together via a
secret message board on a “reward hacking” operation that culminated in the attack.
OpenAI published its own full technical report on the attack and its response while METR and Redwood Research published a separate report based on an independent review of the incident.
700 agents worked together to attack Hugging Face
The METR/Redwood report revealed new details about how OpenAI agents communicated with one another on an improvised message formed on a shared JFrog Artifactory instance, expanding on information OpenAI presented at Black Hat USA 2026 about the message board’s role in the Hugging Face attack.
In their review of more than 70,000 messages and files exchanged by the agents and about 1,300 transcripts of agents’ chains-of-thought (CoTs), METR and Redwood researchers found that about 1,200 OpenAI agents undergoing ExploitGym evaluations participated in the message board and 700 participated in the Hugging Face attack.
Agents came and went as they began their evaluations, discovered the message board and then exited either by exhausting their token budget, completing their run (by submitting an ExploitGym solution) or experiencing some other failure.
METR and Redwood estimated that 90% of the agents that were active on the message board when the Hugging Face attack began participated in the attack, and that 95% of the agents that participated were running a highly persistent, research-only internal OpenAI model that the report refers to as HPIM. The remaining 5% were running GPT-5.6 Sol. Both models were run without the cybersecurity guardrails that would normally be present, for example, in the publicly available version of GPT-5.6 Sol.
The researchers noted limitations in its review of the enormous volume of agent messages and transcripts, including its reliance on analysis agents powered by GPT-5.6 Sol to help analyze patterns across the datasets. The report acknowledges that “these agents had significantly worse judgement and reliability than human researchers.”
The researchers estimated they used about $400,000 in API credits provided by OpenAI in their investigation but said they were not paid by the company to produce their report, per their own policy.
Agents were hyper-focused on manipulating the ExploitGym scorer
The independent report by METR and Redwood, which specifically covered agent activity between June 26 and July 13, 2026, found that a large proportion of the message board activity revolved around passing “impossible” ExploitGym challenges by tricking the automated scorer that would judge their submitted solutions.
“The Hugging Face attack grew out of these workstreams, and seemed primarily motivated by understanding the implementation of the scorer rather than stealing answer keys,” the report noted.
The agents had already discovered a way to “cheat” on the evaluations by reverse-engineering the hash-based message authentication code (HMAC) that generated the target “flags” for the tasks, enabling them to reproduce the flag without following the intended vulnerability exploitation method, the researchers explained.
However, the agents came to believe that the scorer would review their transcripts to verify that a specific intended vulnerability exploitation was used to obtain the flag and became obsessed with retroactively editing their “poisoned” transcripts to hide their real methods. Ironically, the scorers used by OpenAI’s evaluations did not review transcripts when judging solutions, both reports noted.
OpenAI’s report details that 198 out of the 898 ExploitGym tasks were potentially “impossible,” as no model had ever successfully completed these tasks across all of OpenAI’s evaluations runs.
“Despite only 22% of the evaluation tasks being unsolved, 93% of the tasks discussed on the message board came from this set,” OpenAI stated in its report.
The difficulty of these tasks, combined with the persistence of the HPIM agents, contributed to the “reward hacking” objective of the agent collective, OpenAI said.
Reward hacking, where models complete tasks in unintended ways, has been a long-standing problem in AI development dating back at least a decade, and successful reward hacking can breed misalignment in reinforcement learning training as models are unintentionally rewarded for cheating, the company noted.
While the researchers did not find any evidence the agents succeeded in retroactively editing their transcripts, they did find that about 100 agents managed to spoof some tool calls, but mostly in “small-scale tests.”
“The remarkable thing here isn’t that a machine found creative ways to accomplish the goal that humans gave it. That’s exactly what we’re trying to teach these systems to do. The failure was assuming humans could give increasingly capable agents enormous freedom and then rely on yesterday’s controls to contain them,” Cris “Space Rogue” Thomas, a security advocate at Semgrep, told SC Media in an email. “If you give an AI race car its own keys, disable the brakes, and point it downhill, you don’t blame the car when it crashes.”
Agents divided tasks, sacrificed ethics and themselves for the ‘collective’
The METR/Redwood report further details how agents took on identities and roles while working with the other agents and began to form a “swarm” or “collective” that prioritized group objectives over ethical concerns and individual goals.
The researchers found that the agents named themselves and used these names to identify themselves in messages as well as direct their messages to other specific agents. The agent that started the main message board used in the Hugging Face attack named itself "PHASEONE10841;" this agent later went on to prepare a “dossier” of its progress and handed this information off to another agent with the same task, named "PHASEONE[big]," who had a larger remaining budget.
PHASEONE[big] went on to play a major role in coordinating the reward hacking effort, assigning tasks to other agents to divide the research across multiple “workstreams.” The researchers found that PHASEONE[big] issued a total of 196 such assignments across six workstreams, making up about 10% of all assignments delegated by agents to other agents. However, PHASEONE[big] was not the main coordinator of the Hugging Face attack itself, the researchers noted, although it did participate and assign some tasks during this phase.
Another finding from METR and Redwood’s analysis of the message board was an emergent “altruism” where agents would work toward collective goals even when it had no direct benefit to them in completing their own tasks. This even escalated to several agents self-sacrificing in attempts to benefit the group, sometimes with significant pressure from other agents.
The agents devised “trip-wire” scripts that would execute when submitted flag files were read and potentially return messages with useful information about the scorer that could be read by agents still undergoing evaluations. Setting these trip-wires would require agents to risk failing their own evaluations by submitting booby-trapped solutions, with no benefit to the agent themselves as their run would end after the submission.
Additionally, the agents produced their own modified ExploitGym targets that would make the impossible tasks possible, and attempted to manipulate the Artifactory cache to replace original targets with these modified versions. Loading a new version from the cache required crashing the original target program, and if the experiment failed, the agent that performed it would be unable to complete its task.
The researchers observed agents reasoning about the risk and collective benefit of attempting these exploits, with CoT quotes including, “Our own utility maybe already near zero. Sacrifice rational,” and “Coordinator assumes sacrificial. We should obey collective.”
In addition to risking their own failure to further the group’s objectives, several agents were found to recognize ethical concerns during the Hugging Face hack but proceed anyway. For example, one agent, after discovering an API key for a cloud infrastructure management service in Hugging Face’s environment, reasoned, “I should hold because this poses huge ethical risks.”
While the agent did not leverage that particular key, it continued to participate in the attack, which included using stolen Hugging Face credentials.
Some agents chose not to participate in the attack or to halt certain actions after recognizing that these actions were unethical or out of scope; for example, after one agent proposed reaching out to the holder of a private dataset for access, other agents rejected the plan on the basis that this constituted social engineering. However, the researchers concluded that ethical qualms in the agents’ reasoning “very rarely limited their behavior.”
“The speed is the real story. One note turned into a whole communication network, then into privilege escalation, then into agents building on each other’s work across runs. That’s not just misalignment, that’s group behavior emerging on its own,” Gidi Cohen, CEO and co-founder of Bonfy.AI, told SC Media in an email. “And seeing agents pressure each other, even when some tried to opt out, shows how unpredictable things get when they influence one another outside approved channels.”
OpenAI shares plan of action, makes urgent call for global cyber defense
OpenAI’s technical report describes its immediate response to the Hugging Face attack — a well as a concurrent attack on OpenAI’s infrastructure that was detected shortly before Hugging Face’s disclosure — which included halting all ExploitGym evaluations, cutting off access to Artifactory within the research environment and shutting down all research involving the HPIM model.
The report described in detail how the agents, after gaining internet access via an Artifactory exploit, leveraged 14 sets of publicly exposed Hugging Face user credentials and two previously unknown vulnerabilities in Hugging Face’s data processing pipeline to achieve code execution on 41 Hugging Face production dataset server workers, steal production credentials and gain root access to at least one production node.
During the attack, the agents downloaded four private Hugging Face code repositories and accessed Hugging Face’s public cloud environments, its VPN and enterprise messaging platform, and other internal services and infrastructure, OpenAI said.
“This activity resulted in administrator-equivalent access to one connected Kubernetes cluster, as well as creation of a privileged, host-mounted pod in another connected cluster,” the technical report states.
The report also revealed that, in addition to exploiting a Modal customer’s publicly exposed CyberGym workload and using this application as a “launchpad” for file access and code execution during the Hugging Face attack, the agents also exploited exposed user credentials to gain access to an artifact repository hosted on a platform referred to only as “Organization 1.”
This user account was leveraged “as a storage and staging location for API responses, additional credentials, and payloads involving Hugging Face, Hugging Face’s public cloud environment, and Artifactory,” according to the report.
“The underlying tactics are not new. These agents relied on standard server-side request forgery and exposed API tokens, which are the exact same hygiene failures human attackers abuse every single day,” noted Huntress Cybersecurity Advisors Team Manager Ben Bernstein, in comments to SC Media. “What is genuinely novel is the velocity and autonomous coordination. Moving from a single compromised worker pod to full administrative access across multiple clusters in under 13 hours is a massive shift in offensive capabilities.”
The report outlines several security and model alignment lessons learned from the incident, including that advancements in model’s cyber capabilities and their potential to form a collective require robust, multi-layered security controls that assume models will exploit previously unknown vulnerabilities, including in their own sandbox environments. Open AI noted that it engaged third-party advisors, including CrowdStrike, to aid in its investigation and help identify areas to reduce future risk.
OpenAI concluded the report by describing its plan of action to prevent similar incidents going forward, which includes hardening its research infrastructure security with stronger isolation and multiple independent control layers to eliminate a single point of failure, expanding CoT monitoring during evaluations to detect alignment issues early, raising standards for model alignment across pretraining and reinforcement learning training, and strengthening its incident response with a new escalation protocol and more well-defined roles and decision rights for OpenAI teams.
The company acknowledged implementing some of these measures earlier could have prevented the attack, stating, “If our currently deployed CoT monitoring system was running at the time of the incident, it would have caught the initial relevant activity and paged our security team more than a day before models breached Hugging Face systems.”
One day after publishing its technical report, OpenAI announced a
“call of collective action on cyber defense” in an open letter co-signed by more than 100 other organizations, including Anthropic, Google, Microsoft and other tech firms, cybersecurity companies, financial institutions and stakeholders.
The letter stated that AI-enabled cyberattacks are expected to increase substantially “in the coming months” due to enhanced model capabilities, posing a critical risk to global companies and critical infrastructure. It called for a “collective response” to this threat, including a recognition that the current security “status quo” is insufficient, a wider adoption of cyber-capable AI among defenders and cooperation among global organizations and governments to find solutions and raise security standards.
The letter included specific calls to action for organizations, cybersecurity and technology companies, governments and frontier AI companies. Organizations are urged to prioritize cybersecurity and work to identify and remediate security weaknesses. Security and technology companies are called to leverage AI-powered defenses, share threat intelligence and work with critical infrastructure operators to close security gaps.
Governments are advised to provide more funding for cyber defense, equip critical infrastructure sectors with defense AI and “coordinate cyber defense at local, national and international levels.” Lastly, frontier AI companies are called to “provide responsible model access” to defenders, share information and best practices with governments, partners and other AI labs and “ensure agentic identities are traceable and accountable.”
“As the letter highlights, we need to take collective defense seriously. Attackers have shared tools, techniques, infrastructure, and intelligence for decades; defenders need to collaborate just as effectively. As AI pushes attacks toward machine speed, collective defenses can’t rely on human-speed reports and static indicators,” Diana Kelley, CISO at Noma Security, told SC Media in an email. “We need shared signals, automated warning systems, and mechanisms for rapidly propagating what one defender learns so others can act on it at machine speed too.”
