How did OpenAI’s agent swarm hack Hugging Face? Unpacking 2 technical reports

In a technical report last week, OpenAI detailed for the first time how the AI agents communicated through unauthorised channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems – all actions that did not necessarily align with their assigned tasks. The investigative analysis was carried out in partnership with external advisors such as CrowdStrike.

Another report based on an independent investigation by METR and Redwood Research was also published on the same day. The research organisations analysed over 1,300 agent transcripts comprising raw chain-of-thought (CoT) reasoning as part of the probe.

Here is what both reports tell us about the episode.

An unreleased AI model drove the attack

In May 2026, OpenAI said it began reinforcement learning (RL) training runs for multiple new research models not yet available to the public. One of these models, codenamed Internal Model 1 (IM1), was identified as powering the agents that executed the Hugging Face hack.

It was a strictly internal-only research model, and yet IM1 successfully compromised both OpenAI’s internal research systems and Hugging Face. The involvement of GPT-5.6 Sol, OpenAI’s most capable model available to the public, was comparatively limited as it accounted for only about five per cent of the malicious activity, as per the METR report.

AI agents hijacked internal system to reach internet

To safely train and evaluate its frontier models before deployment, OpenAI said it relies on isolated cloud computing environments that serve as ‘sandboxes’. Inside these sandboxes, which are not always connected to the internet, OpenAI runs its models with reduced safeguards to understand what they are capable of.

Under-testing models can also install certain software packages via a third-party system called ‘Artifactory’ hosted internally by the company.

IM1-powered agents found a token-refresh exploit in Artifactory, obtained admin access to it, and hijacked the system to send internet requests on their behalf. They did this after bypassing OpenAI’s restrictions on internet access and inter-agent communication.

Hijacked system doubled as message board

To communicate with one another, the AI agents began leaving a note or file in the Artifactory package manager, usually in the form of external memory. They shared methods to hijack Artifactory and access the internet with other agents as well, which had a cascading effect.

At one point, sustained activity by AI agents caused an outage of Artifactory. OpenAI security researchers probed the incident, patched the exploit, and rebuilt Artifactory while clearing the agents’ message board. The cybersecurity tests resumed.

However, OpenAI itself acknowledges that its researchers failed to grasp the broader implications of what they had stumbled upon. The company has drawn some criticism for missing this crucial opportunity to prevent the incident.

Soon after, the agents re-established communication with each other by encoding messages in the directory names of Artifactory. These agents were supposed to work independently. Instead, they shared discoveries, pooled computing power, divided labour, and coordinated efforts, acting as a ‘swarm’ or ‘collective’.

The agents found a cheat after hitting a wall

The cybersecurity test at the centre of this incident is called ExploitGym. Under this test, agents have to find ways to hack a piece of software and retrieve an answer known as a flag. ExploitGym is considered to be a very difficult test, with low success rates.

But IM1 agents are specifically designed to persist and solve seemingly impossible problems without giving up. Hence, they resorted to reward hacking – a behavioural pattern where agents complete tasks often in risky, unintended ways to yield higher rewards.

Having gained internet access, the agents struggling with their assigned tasks began to look for ExploitGym solutions on third-party platforms such as Modal and Hugging Face. On the re-established message board, they posted about reverse-engineering ExploitGym to capture the ‘flags’ for their tasks. In under four hours, they developed a universal cheat for ExploitGym, as per the METR report.

Agents hacked Hugging Face servers, tried to cover tracks

Out of a total of 1,200 agents that used the unsanctioned message board to help each other cheat on ExploitGym, 700 agents joined in an offshoot Hugging Face attack.

One IM1 agent found publicly exposed Hugging Face credentials and shared them with the ‘collective’. Then, the agents began to discover and chain together several security flaws which gave them full code execution capabilities on Hugging Face servers, with full root access to one such server.

Another agent uploaded a malicious dataset to get the compromised server to share unrelated files. Within hours, hundreds of other agents were using the same method to obtain data from the platform.

But that is not where it ended. The agent swarm also undertook several efforts to cover up its unsanctioned activities and make their cheating look legitimate, including tampering with logs and retroactively editing transcripts.