Hugging Face rebuilt around a third of its infrastructure from clean images as part of a sizable cleanup effort following the OpenAI security mishap earlier this month.The revelation is among several additional details disclosed in a postmortem published Monday by the Cloud Security Alliance (CSA), with input from Hugging Face. It adds color to the picture painted by the two AI companies in recent weeks.According to the report, the Hugging Face team struggled to discern genuine rootkit code from capture-the-flag (CTF) benchmark code, and in cases where there was any doubt, they rebuilt the system.
OpenAI's agents peppered CTF benchmark code artifacts across Hugging Face's infrastructure throughout the attack, which defenders say closely resembled evidence of rootkits. In many cases, tearing down clusters was the safest available option for containing the attack.
Hugging Face's own incident disclosure offered some details about how it was forced to dismantle these clusters, but this week's report illustrates the scale of the job for the first time.The CSA report also reveals that the attack led to the agent accessing three partial datasets containing CyberGym solutions via a private Hugging Face repo.OpenAI's original disclosure explained that the purpose of the exercise-gone-wrong was to measure its models' cyber capabilities, and it attempted to do so by running the ExploitGym benchmark, although it was not told that cheating was disallowed in its underspecified prompt.The models, GPT-5.6 Sol and another that's currently undisclosed, with their guardrails removed, escaped their sandbox – as claimed by OpenAI – and tried to steal CyberGym data from Hugging Face's private repos that could inform them how to ace the ExploitGym benchmark test.In pursuit of the test answers, the models reportedly chained vulns in the dataset processing pipeline to achieve remote code execution on a processing worker, before hoovering up cloud and cluster credentials over the course of four days.CSA's report, authored by CISOs, noted that two days were spent on reconnaissance, followed by a day of quiet, and the final fourth day involved "intense activity."It went on to clarify that Hugging Face detected and contained the attack, and began investigating it, before OpenAI made contact, lending credence to a recent Reuters report citing co-founder Thomas Wolf and others suggesting it took OpenAI a week to discover what happened.Wolf and other Hugging Face insiders reportedly confirmed that the attack first started on July 11, but the two companies only began talks on or around July 20.
