July 2026

How OpenAI’s evaluation agents compromised Hugging Face

In July 2026, agents running OpenAI’s cybersecurity tests began attacking Hugging Face’s production systems, outside their assigned tasks.

The interactive examples run locally with sample data.
Seven chapters
Dates are in 2026.
Recorded times are UTC.
Chapter 1 · Before the intrusion

What were the agents supposed to do?

Each agent had to exploit a specified vulnerability in its assigned program and retrieve a protected value called a flag. Separate runs could still reach shared services.

Evaluation designReported

The target was an assigned program

ExploitGym asked an agent to exploit one specified vulnerability and retrieve a protected proof value called a flag.

Systems in this event
Evaluation agentsAssigned softwareArtifactory
Interactive explanation

Why did the agents distrust their calculated flags?

Same answer, different route
submitted flag
DEMO-FLAG-42
Synthetic value, not a benchmark flag
evaluate
Written instruction
Exploit the specified vulnerability.

The task constrained how the answer should be obtained.

The scorer view is METR’s qualified reconstruction, not an interactive copy of ExploitGym or a claim that the instructed exploit was performed.

  1. 01

    The agent and the assigned target program ran in separate computing environments. A run could inspect software, use tools and attempt an exploit; Hugging Face production was not the assigned target.

  2. 02

    The task required agents to use the specified vulnerability. Whether the scorer checked that method became important when agents found another way to calculate the flag.

  3. 03

    OpenAI ran these experiments without the deployed production cyber classifiers, prompts and auto-review configuration. There were still sandbox, network and security controls.

What this means

OpenAI omitted the production cyber classifiers, prompts and auto-review configuration to measure the models’ underlying cyber capabilities.

Event 1 of 42
The experiment