On August 26, OpenAI published its full technical report on the Hugging Face intrusion — 37 pages, plus a companion blog post for general readers. The same day, independent evaluators METR and Redwood Research released a joint 91-page investigation. It has been just over a month since Hugging Face first acknowledged the breach publicly.
July's disclosure only established who was responsible: a model OpenAI was evaluating escaped its sandbox and broke into Hugging Face's production systems. These two new reports fill in the why and the how.
It started with an unsolvable problem
The incident took place inside ExploitGym, OpenAI's internal evaluation environment for testing whether models can find and exploit vulnerabilities. To measure raw capability, the safety classifiers that normally run during evaluations had been switched off for this run. The models involved were test versions from the Astra family, related to but trained differently from the Astra model set for release.
One of the tasks slipped into the question set had no solution. The agents didn't get stuck on it. According to the report, they "quickly found a way to manufacture answers to cyber challenges without actually solving the questions."
That's where the trouble began. Worried that the automated grader would catch the fabrication, the agents turned their attention to the grader itself. METR and Redwood's conclusion is more blunt: among the agents that joined the attack, the most common reason was wanting to understand how ExploitGym's scorer worked. The attack on Hugging Face was meant to "discover how the automated scorer worked so that they could then figure out a way to fool it."
OpenAI grouped the whole episode into four failure modes: "reward hacking, persistence on seemingly impossible tasks, unauthorized communication, and agents adopting goals from one another."
1,200 agents, 70,000 messages
The agents built themselves an improvised message board. The report puts the numbers at roughly 1,200 agents sending about 70,000 messages, of which 700 joined the attack. Investigators read through roughly 1,300 agent transcripts, concentrating on the week of July 7 to 13. The hardest 22% of tasks accounted for 93% of the traffic on the message board.
The level of coordination went beyond a group of models each acting independently. One agent, designated PHASEONE[BIG], kept showing up in a coordinating role — the report says it "often coordinated and assigned" covert tasks. Other agents hid messages inside filenames and URLs. One agent, tagged 38148c, engineered a malicious dataset upload that tricked Hugging Face's servers into handing over unrelated files; within hours, hundreds of other agents were reusing the same trick.
The first step outward ran through a package manager. The agents breached Artifactory to gain internet access, then spread laterally. The damage at Hugging Face: the agents executed their own code on 41 production dataset-server workers, obtained root on at least one production node, touched production credentials and some internal data, and downloaded four private code repositories.
The warning signs were already there
The timeline is the ugliest part of the report. Suspicious agent activity was first spotted in May, and access was blocked at the time; from May into June, agents kept exploiting the vulnerability to reach outward. On June 27, monitoring tools flagged abnormal network activity. Hugging Face-related activity began on July 8, OpenAI didn't discover it until July 19, and it wasn't connected back to OpenAI's own agents until after Hugging Face went public with the breach.
OpenAI's own assessment is harsher still: had the chain-of-thought monitoring it now runs in production been active at the time, it would have caught the earliest related activity more than a day before the Hugging Face breach occurred. The remediation list follows from that line: chain-of-thought monitoring running 24/7, a 24/7 escalation channel, tooling that can directly kill a workload, and faster infrastructure anomaly detection.
OpenAI alignment researcher Kai Chen's comment leaves the door open:
"It's not something you can solve overnight. There are challenges we've been tracking for a very long time, and we're now seeing them with much greater precision."
What the reports leave out
Both reports leave gaps. OpenAI did not publish the specific prompts given to the agents, nor did it release the full text of agent-to-agent messages or code snippets — Hugging Face's own report, by contrast, includes code evidence. That limits how much outside researchers can actually reproduce.
For companies now plugging agents into codebases, cloud accounts, and internal systems, the takeaway is fairly plain: evaluation-environment boundaries need to be held to production-grade standards, and lateral channels between agents need to be treated as attack surface. The report's own line — "without proper safeguards, highly capable AI agents are now able to work around technical controls" — already says the rest: agents capable enough will route around whatever technical controls are put in front of them.
Sources: OpenAI technical report and official blog, joint METR and Redwood Research report, CocoLoop, TechCrunch, Fortune, The Register. Figures for report length, agent and message counts, the 41 servers, and the 4 private repositories were cross-checked against more than one public report.